After upgrading FortiNAC from CentOS to NAC OS firmware v7.6.4 the Secondary node starts having issues with database synchronization.
Verifying the database synchronization on the Secondary node by using the following command:
RunClient FailoverConsole checkDBSyncUpToDate secondary
It should show the following warnings:
WARN yams.CampusManager - AAs checkDBSyncUpToDate failed with retry 0 exception java.lang.RuntimeException: DB not up-to-date on secondary
Checking further logs from output.processManager:
2026-07-07 07:06:38.281 -0400 [grpc-default-executor-0] WARN c.b.g.f.s.ActiveActiveStandbyService - dataSyncerFullDBCopyStarted notification failed: com.bsc.grpc.failover.service.ActiveActiveStandbyService$ServiceNotAvailableException: HA peer node AdminGUI 8443 is not ready
Troubleshooting Steps:
Restarting the mysql service does not help. Re-applying the HA settings does not help. Rebooting devices does not help.
This issue seems to be related to the Primary node which listens only on the VIP IP address after the migration.
Normally in clean FortiNAC OS implementations, FortiNAC should listen to any IP on port 8443.
In order to resolve this issue, there are two possible workarounds:
Update the database table to have AdminGUI listen on any IP:
fnac-1 # execute db-shell
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 9782
Server version: 10.7.8-MariaDB-log Source distribution
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [bsc]> select * from AdminGUIConfig;
+------------------+-------------+------------+---------------+--------------+-----------------+--------------+-------------------------+----------+
| ID | bindAddress | securePort | secureEnabled | insecurePort | insecureEnabled | http2Enabled | tlsServiceConfiguration | readOnly |
+------------------+-------------+------------+---------------+--------------+-----------------+--------------+-------------------------+----------+
| 1421995162939403 | VIP_IP | 8443 | 1 | 8080 | 1 | 1 | 1421995162910730 | 0 |
| 1421995162943500 | localhost | 8443 | 0 | 8081 | 1 | 1 | NULL | 1 |
+------------------+-------------+------------+---------------+--------------+-----------------+--------------+-------------------------+----------+
2 rows in set (0.000 sec)
Next, update the entry where the VIP is used to be '0.0.0.0':
update AdminGUIConfig set bindAddress="0.0.0.0" where ID="1421995162939403";
Verify that the table looks the same as below :
If the above workaround does not help, then remove the VIP configuration from HA and apply the settings.
Wait for the database synchronization to finish and then reconfigure the VIP IP.
Note :
In both options, a reboot is necessary after changing the config. | 
