Technical Tip: FortiGate HA Out-of-sync issue on v7.6.3

Zero-day malware stream scanning, which allows FortiGate devices to receive IOCs using a new daemon ‘fortimq’.  However, this can cause an out-of-sync state between HA cluster members:

Solution:

This is a known issue, tracked under reported ID: 1165798, which has been resolved on FortiOS version 7.6.4 and the upcoming version 8.0.0.

Workaround:
Disabling the '0-day malware stream scanning' can be implemented as a workaround:

1. Go under FortiGate Primary GUI -> Security Profiles -> AntiVirus -> Select profile, where the feature is enabled -> Virus Outbreak Prevention, and disable ‘Use 0-day malware stream scanning’.
2. Select 'OK' to save profile changes.

3. If required, manually resynchronize the HA cluster by following the KB article: Technical Tip: Procedure for manual synchronization for HA out-of-sync issue.

Related article:
Troubleshooting Tip: HA synchronization issues: Antivirus profile mismatch