Technical Tip: FortiGate HA cluster fails to connect to FortiManager via FQDN after failover

Description

This article describes a known issue where a FortiGate HA cluster loses connectivity to FortiManager (including FortiManager Cloud) after upgrading to FortiOS v7.4.9 when central management is configured using an FQDN.

Scope

FortiOS v7.4.8, v7.4.9, v7.6.4.

Solution

Following an HA failover, the FortiGate unit is unable to re-establish the FGFM connection, leaving the device disconnected from FortiManager. Central management configured with FQDN may fail after HA failover due to an undestroyed FGFM session.

Example configuration:

config system central-management
    set type fortimanager
    set serial-number "FMGVMSTM2XXXXXXX"
    set fmg "fmg.xxx.fortilab.net"
end

diagnose fdsm central-mgmt-status

Connection status: Down  
Registration status: Unknown
Serial:

Workaround:

Kill the fgfmd process on FortiGate using 'fnsysctl killall fgfmd'.

To apply the workaround automatically after failover, configure an automation stitch:

config system automation-trigger
    edit "Detect_HA_Failover"
        set event-type event-log
        set logid 37892
    next
end

config system automation-action
    edit "Restart_FGFMD-process"
        set action-type cli-script
        set script "fnsysctl killall fgfmd"
        set accprofile "super_admin"
    next
end

config system automation-stitch
    edit "Automation_FGFMD-Restart"
        set trigger "Detect_HA_Failover"
            config actions
                edit 1
                    set action "Restart_FGFMD-process"
                    set delay 5
                    set required enable
                next
            end
    next
end

Reconfiguring FortiManager using an IP address instead of a FQDN also avoids the issue. However, this is not an option when using FortiManager Cloud.

Verifying FortiGate is connected to FortiManager:

diagnose fdsm central-mgmt-status

Connection status: Up
Registration status: Registered
Serial: FMGVMSTM2XXXXXX

Resolution:

Upgrade to FortiOS v7.4.11, v7.6.6, or later version.

Related articles:

• Troubleshooting Tip: How to troubleshoot connectivity issues between FortiGate and FortiManager

• Troubleshooting Tip: Understanding 'fgfm diagnose debug' log