Technical Tip: Firewall SSH local-key host-key are not syncing over HA for G series FortiGate on FortiOS version 7.4

Description

This article demonstrates the behavior of configuring SSH host-key or local-key on G series FortiGate HA cluster running firmware version 7.4. When this is configured on a G-series FortiGate HA cluster running firmware version 7.4, the host/local-key does not get synced over HA. This is fixed in FortiOS version 7.6.5 onwards.

Scope

FortiGate G series on firmware version 7.4.

Solution

1. HA is initially in-sync:
   
   

   

   
   

2. Configure ‘firewall ssh host-key’. This is an example host-key that can be configured to test this.

config firewall ssh host-key
    edit "test"
        set type ECDSA
        set nid 384
        set ip 10.191.1.231
        set public-key "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBH7XZSU8K/xnXxkFoT7/TqY56E2q6CfZLY+zArVImvAnnB6HW9gbHh+jpIFNvi/uDNLGDz/oVAMw8lHA5EGCBsIgK9A+erhb633LorfePonfRe9W4rUSNlzp48gIiGybCg=="
    next
end

3. After configuring the SSH host-key (the same behavior is seen on local-key), the HA goes out-of-sync:
   
   

4. On the FortiGate GUI, System -> HA, the HA is out-of-sync. After hovering the mouse over the ‘Not Synchronized’ text, the respective object that caused the HA to go out-of-sync can be seen:
   
   

5. Verifying this in the CLI, the ‘firewall ssh host-key’ configuration on the secondary firewall is not present and did not sync over HA:
   
   

This is a known issue that happens on FortiGate G series firewalls running the version 7.4 firmware. This issue is not seen on FortiGate G series running FortiOS firmware version 7.6.6.

Workaround:

Manually configure the ‘firewall ssh host/local-key’ on the secondary firewall in the HA cluster.