Skip to main content
LiaoYuRuei
New Member
December 18, 2017
Solved

HA checksum

  • December 18, 2017
  • 2 replies
  • 14451 views

I learned about the ha checksum on Fortinet , the "link".

 

some of the contents as follow :

 

The following command output is for the primary unit of a cluster that does not have multiple VDOMs enabled:

diagnose sys ha checksum show

is_manage_master()=1, is_root_master()=1

debugzone

global: a0 7f a7 ff ac 00 d5 b6 82 37 cc 13 3e 0b 9b 77

root: 43 72 47 68 7b da 81 17 c8 f5 10 dd fd 6b e9 57

all: c5 90 ed 22 24 3e 96 06 44 35 b6 63 7c 84 88 d5

 

checksum

global: a0 7f a7 ff ac 00 d5 b6 82 37 cc 13 3e 0b 9b 77

root: 43 72 47 68 7b da 81 17 c8 f5 10 dd fd 6b e9 57

all: c5 90 ed 22 24 3e 96 06 44 35 b6 63 7c 84 88 d5

The following command output is for a subordinate unit of the same cluster:

diagnose sys ha checksum show

is_manage_master()=0, is_root_master()=0

debugzone

global: a0 7f a7 ff ac 00 d5 b6 82 37 cc 13 3e 0b 9b 77

root: 43 72 47 68 7b da 81 17 c8 f5 10 dd fd 6b e9 57

all: c5 90 ed 22 24 3e 96 06 44 35 b6 63 7c 84 88 d5

 

checksum

global: a0 7f a7 ff ac 00 d5 b6 82 37 cc 13 3e 0b 9b 77

root: 43 72 47 68 7b da 81 17 c8 f5 10 dd fd 6b e9 57

all: c5 90 ed 22 24 3e 96 06 44 35 b6 63 7c 84 88 d5

 

1.Does anyone know that what is the meaning of 「global、root、all」?

2.If I have 2 fortigates, steup for ha, but the checksum mismatch on the root and all line, what does it mean?

    Best answer by gdifiore

    I know it has been a while, but i just came across your question.  

     

    The global is all global configuration on the firewall (admin profiles, users, fortiguard etc)

    The root is all the settings related tot he root vdom, (interfaces, policies, address objects, security profiles, etc)

    The all is a combination of the global and root (and any other vdoms you may add).  This is a checksum for the overall config.

     

    If the root checksum does not match, and therefore the all checksum will not match, you have a configuration that did not sync.  Here is a good article that talks about how to drill down through the different modules to find where the problem is and how to force a resync.

     

    http://kb.fortinet.com/kb/documentLink.do?externalID=FD36176

     

    2 replies

    gdifiore
    gdifioreAnswer
    New Member
    April 5, 2018

    I know it has been a while, but i just came across your question.  

     

    The global is all global configuration on the firewall (admin profiles, users, fortiguard etc)

    The root is all the settings related tot he root vdom, (interfaces, policies, address objects, security profiles, etc)

    The all is a combination of the global and root (and any other vdoms you may add).  This is a checksum for the overall config.

     

    If the root checksum does not match, and therefore the all checksum will not match, you have a configuration that did not sync.  Here is a good article that talks about how to drill down through the different modules to find where the problem is and how to force a resync.

     

    http://kb.fortinet.com/kb/documentLink.do?externalID=FD36176

     

    LiaoYuRuei
    New Member
    April 6, 2018

    gdifiore wrote:

    I know it has been a while, but i just came across your question.  

     

    The global is all global configuration on the firewall (admin profiles, users, fortiguard etc)

    The root is all the settings related tot he root vdom, (interfaces, policies, address objects, security profiles, etc)

    The all is a combination of the global and root (and any other vdoms you may add).  This is a checksum for the overall config.

     

    If the root checksum does not match, and therefore the all checksum will not match, you have a configuration that did not sync.  Here is a good article that talks about how to drill down through the different modules to find where the problem is and how to force a resync.

     

    http://kb.fortinet.com/kb/documentLink.do?externalID=FD36176

     

    Thank you for your reply!

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!