In Fortigate before version 7.6.7, the HA cluster may be unable to synchronize configurations after upgrading in the case that the HA cluster is upgraded with PDE option enabled.
First check the option status:
FGT # sh full-configuration | grep private-data-encryption
set private-data-encryption enable
If the option is enabled, further attention is required.
Reactive approach:
The only solution (if you have already upgraded) is to disable the option ephemerally on a master device, recalculate checksums, then restart the synchronization process from a secondary unit.
config system global
set private-data-encryption disable
end
diagnose sys ha checksum recalculate
Next, access to the secondary unit is required.
Recalculate checksums and restart the synchronization.
execute ha manage <id> <username>
diagnose sys ha checksum recalculate
execute ha synchronize start
Proactive approach:
It is easier to prevent the issue by disabling private-data-encryption before upgrading.
config system global
set private-data-encryption disable
end
After a successful upgrade or after fixing the synchronization, the option can be re-enabled on the master device.
config system global
set private-data-encryption enable
end
| 
