HA out-of-sync after upgrade to 6.4.5

Forum|Forum|5 years ago
March 11, 2021
3 replies
7988 views

hello everybody,

I recently updated an ha cluster of 100E from 6.2.2 to 6.4.5 following the suggested upgrade path

after the update the HA cluster status is out-of-sync, I checked using diag sys ha checksum and I found a firewall address named FCTEMS_ALL_FORTICLOUD_SERVERS created on both master and slave but with different UUID

I tried to set the UUID manually but I get the error "UUID attribute cannot be set directly", I tried to delete the object, it was deleted on both master and slave and the conf appeared in-sync but after a few minutes the address is automatically re-created with different UUID on the two firewalls and the HA status is out-of-sync

did anybody face this issue and found a solution?

thanks!

6.4

Best answer by Toshi_Esumi

I haven't experienced that problem because we haven't upgraded any HA clusters to 6.4 yet. But I would open a ticket immediately if we encountered. TAC, likely needs to be Tier2, should be able to explain why and how to fix it at least temporarily in case a bug.

Meanwhile, I would search the UUID of the master unit in the slave config to see if any comflict. Sounds impossible but you never know. Then if it doesn't exist, just delete it once on both units as you did before then manually re-create with the same name, but change the type to like ipmask and set a bogus IP/mask instead of dynamic to see it would be copied to the slave with the same uuid. My assumption is if the same name exists, FGT wouldn't be able to create it automatically.

If manual method also create a different uuid at the slave, definitely needs help from TAC.

Toshi_EsumiAnswer

SuperUser

I haven't experienced that problem because we haven't upgraded any HA clusters to 6.4 yet. But I would open a ticket immediately if we encountered. TAC, likely needs to be Tier2, should be able to explain why and how to fix it at least temporarily in case a bug.

Meanwhile, I would search the UUID of the master unit in the slave config to see if any comflict. Sounds impossible but you never know. Then if it doesn't exist, just delete it once on both units as you did before then manually re-create with the same name, but change the type to like ipmask and set a bogus IP/mask instead of dynamic to see it would be copied to the slave with the same uuid. My assumption is if the same name exists, FGT wouldn't be able to create it automatically.

If manual method also create a different uuid at the slave, definitely needs help from TAC.

alexnenciAuthor

New Member

I was able do delete the address FCTEMS_ALL_FORTICLOUD_SERVERS and create a new one manually with a bogus IP then it was replicated automatically on the slave with the same UUID.

After a few minutes it was automatically converted to type dynamic and sub-type ems-tag maintaining the same UUID.

Thanks for your suggestion, this seems to be a good workaround

Sign up

Login with SSO

Login to the community

Login with SSO