Skip to main content
desaia
Staff
desaia
Staff
February 25, 2026

Troubleshooting Tip: FortiGate VM in HA stuck during upgrade with 'error=111 (Connection refused)'

  • February 25, 2026
  • 0 replies
  • 203 views
Description This article describes how to troubleshoot and recover a FortiGate VM deployed in an HA configuration on Microsoft Azure when the upgrade process becomes stuck and the console displays an error=111 (Connection refused) message.
Scope FortiGate VM.
Solution

During an upgrade of FortiGate VMs configured in an HA setup on Azure, the upgrade may stall. The following error message can be observed in the console logs of the Secondary FortiGate VM:

2026-02-08 10:23:31.351 [__ha_send_req_ex:1523] pid-9232 ha req connect failed: type=35, dst_ip=169.254.0.2, error=111(Connection refused)

This error indicates that the Secondary FortiGate VM is unable to establish HA communication with its peer over the HA link. This may occur due to:

  1. A failed or incomplete upgrade process.
  2. Temporary HA service failure.
  3. VM-level connectivity or OS disk issues in Azure.

As a result, the HA synchronization process fails and the upgrade does not complete successfully.

 

To troubleshoot the issue:

 

  1. Restart the Secondary VM from the Azure portal or CLI - monitor the console logs after reboot to confirm whether HA communication is restored and the upgrade completes.

  2. If the issue persists after rebooting the Secondary FortiGate VM, restore the VM from a known-good Azure snapshot that was taken prior to the upgrade attempt.

 

Refer to the following knowledge base articles for detailed recovery and snapshot procedures:
    Terms & ConditionsAccessibility statement