Troubleshooting Tip: Failed Upgrade to v7.6.6 on HA Cluster when Private Data Encryption is enabled and HA password is set

Description

This article describes how to prevent configuration loss and upgrade failures when upgrading to FortiOS v7.6.6 from versions v7.2 or v7.4 with Private Data Encryption (PDE) enabled.

Scope

FortiGate, High Availability (HA).

Solution

In HA environments where Private Data Encryption is enabled, upgrading to FortiOS v7.6.6 may result in a split-brain condition. This occurs due to loss of HA communication between cluster members, caused by the HA password becoming unsynchronized during the upgrade process.

In this scenario:

• The secondary unit completes the upgrade successfully.

• The primary unit does not upgrade, as the HA cluster becomes unstable and communication is lost.

Root cause:

On certain FortiOS v7.4 builds, the AES-256 PDE key may be stored in an incorrect format where the second 16 bytes do not match the first 16 bytes as expected. As a result, upgrading one member of an HA cluster with Private Data Encryption (PDE) enabled from FortiOS v7.4.9 to v7.6.6 can lead to HA synchronization failure and a split-brain condition.

Workaround:
Disable Private Data Encryption before upgrading, then re-enable it after the upgrade.

Before upgrade:

config system global
    set private-data-encryption disable
end

 
After upgrade:

config system global
    set private-data-encryption enable
end

This issue (1283092) has been resolved in FortiOS v7.6.7 and will be fixed in FortiOS v8.0.1, scheduled to be released in July 2026.

Related article:

Resolved issues (FortiOS v7.6.7)