Technical Tip: Troubleshooting HA upgrade timeout issue on FortiGate devices

Description

This article describes troubleshooting steps for resolving HA upgrade timeout issues on FortiGate devices. The user may encounter this issue when upgrading the firmware of their FortiGate devices in a high availability (HA) cluster.

Scope

FortiGate.

Solution

To troubleshoot the HA upgrade timeout issue on FortiGate devices, follow these steps:

Check the HA settings on the FortiGate devices to ensure that the uninterruptible upgrade mode is enabled.

v7.4.0 and earlier:

config system ha
    set uninterruptible-upgrade enable
end

v7.4.1 and later:

config system ha
    set upgrade-mode uninterruptible
end

This mode allows the upgrade process to complete without interrupting the traffic.
Verify that the heartbeat cables are connected directly between the two FortiGate devices in the HA cluster.

Run the following commands on the primary FortiGate device to verify the HA uninterruptible wait time:

show full system ha | grep "uninterruptible-primary-wait"
set uninterruptible-primary-wait 30 

The default is 30.

Run the following debug commands on the primary FortiGate device to enable debugging for the HA upgrade process:

diagnose debug disable
diagnose debug reset
diagnose debug application hatalk -1 
diagnose debug application hasync -1 
diagnose debug console timestamp enable 
diagnose debug enable

To disable the debug processes:

diagnose debug reset
diagnose debug disable

 
Proceed with the upgrade process and monitor the debug logs to identify any issues that may be causing the timeout.

For more information on configuring the HA uninterruptible upgrade mode, refer to Technical Tip: Configure timeout to make primary HA unit wait before the secondary HA unit is considered upgraded (uninterrupted upgrade is enabled).