A/V & IPS out of sync

Easy: in CLI: conf global execute ha manage <id of slave> now you are inside the slave

Do you have a sync issue or why would you not rely on the cluster management doing the updates for you? Usually the primary updates the signatures on the slaves, via the HA link. This is a must on an A-A cluster but is also the case on an A-P cluster:

fw01 # get sys stat  Version: Fortigate-310B v4.0,build0196,100319 (MR1 Patch 4)  Virus-DB: 12.00346(2010-09-13 00:11)  Extended DB: 12.00346(2010-09-13 00:12)  IPS-DB: 2.00861(2010-09-10 02:10)  FortiClient application signature package: 1.215(2010-09-12 20:36)  ...  Current HA mode: a-p, master  ...    fw01 # exe ha manage 0    fw02 $ get sys stat  Version: Fortigate-310B v4.0,build0196,100319 (MR1 Patch 4)  Virus-DB: 12.00346(2010-09-13 00:11)  Extended DB: 12.00346(2010-09-13 00:12)  IPS-DB: 2.00846(2010-08-11 12:54)  FortiClient application signature package: 0.0(2010-09-13 08:58)    

I cannot remember ever doing it manually. If I had to it wouldn' t be feasable in regular intervals.

I had the issue once, with the slave not having the latest signatures (see http://support.fortinet.com/forum/tm.asp?m=63296&appid=&p=&mpage=1&key=&language=&tmode=&smode=&s=#63296) I am not sure whether the slave was/should be able to reach FDN (may be a Firewall between FGT and Internet). It even got that far that the slave didn' t show a updated licence, resulting in a " The licence will expire in 2 days" Error. According to FGT Support, this should have no impact on the cluster (aparently it hadn' t) but left a bad taste.. I switched prioritys to change the master now it updated the signatures and licence, but the slave was stuck.. maybe it was a connection error in my setup, pinging fdn from slave was not possible.

In my experience, I never had problems with the slave being out of sync. Upon a failure and the slave becomes active, and the slave has an active license, it will automatically sync it' s AV/IPS signatures.