Troubleshooting Tip: FortiGate HA out of sync after upgrading to version 7.4.8

FGT-Primary # config system central-management  FGT-Primary (central-management) # show config system central-management     set type fortimanager     set serial-number "FMG-VMTMXXXXXXXX"     set fmg "10.10.10.10"     set vdom "vsys_hamgmt" end 

FGT-Secondary # config system central-management  FGT-Secondary (central-management) # show config system central-management     set type fortimanager     set serial-number "FMG-VMTMXXXXXXXX"     set fmg "10.10.10.10" end

As seen in the output of the Primary FortiGate, it started showing the hidden VDOM vsys_hamgmt, but on the secondary node it is not showing the same because the default VDOM is root.

This issue can be fixed by setting the vsys_hamgmt VDOM back to root by running the following commands on CLI.

FGT-Primary # config system central-management FGT-Primary (central-management) # set vdom "root"

If the issue returns after each deployment from FortiManager, this is likely caused by an unsupported configuration where the FortiManager communicates with the HA reserved management interfaces. This is not supported, as indicated in the admin guide by the following statement:

• Reserved management interfaces and their IP addresses should not be used for managing a cluster using FortiManager. To manage a FortiGate HA cluster with FortiManager, use the IP address of one of the cluster unit interfaces.

This setup may also cause issues where the primary device is not reachable, or when it is not the primary unit anymore, when a policy push is made in the void or to the secondary device.

In either scenario, change the connection between the FortiManager and the FortiGate device so that it uses a shared interface that always points to the primary device. The easiest way of doing this is to right-click on the FortiGate in FortiManager under Device Manager and select Edit to modify the IP address that FortiManager uses to connect to the device. In this configuration setting, point it to a shared interface, assuming there is connectivity from FortiManager to that interface on the FortiGates.

Related article:

Technical Tip: HA Reserved Management Interface's hidden VDOM (vsys_hamgmt VDOM)