Skip to main content
robinct
robinct
New Member
April 24, 2020
Solved

HA switch over changed policy using internet service

  • April 24, 2020
  • 1 reply
  • 4083 views

Just had an interesting experience when updating an HA a-p setup.

 

The failover unit was re-installed earlier this year due another issue. When updating firmware, it turns out the passive unit had an older version of the Internet Service Database Definitions. Given this, the unit simply replaced the services involved in the policy as some of the services didn't exist in the current version.

 

The policy had Microsoft-Office365, Microsoft-Microsoft.Update and Microsoft-Azure defined. After the failover switch, the policy was replaced with Microsoft-Office365, Microsoft-Other and Microsoft-Other.

 

How can I make sure this doesn't happen future wise? 

    Best answer by localhost

    You can compare ISDB versions with:

     

    #diag autoupdate versions

     

     

    1 reply

    localhost
    localhost
    Visitor III
    April 24, 2020

    Was the cluster configuration in sync before you started the upgrade?

     

    We ran into similar problems, were ISDB entries just got deleted, when doing a multi-step firmware upgrade. This happens when the ISDB is out-of-date or empty.

    Not sure if they fixed this in later firmware versions.

     

    What I do is:

    - Run Firmware Upgrade

    - check if ISDB entries are populated again

    - If not: execute a fortiguard refresh (System->Fortiguard, Update AV&IPS Definition)

    - run #diagnose debug config-error-log read

    - do next firmware upgrade

    robinct
    robinctAuthor
    New Member
    April 24, 2020

    Yes, the configuration was in sync before the upgrade.

     

    The config-error-log shows no errors. I still have a second upgrade to do, so will check versions between the two different units. If I understand correctly, the normal procedure would be that the two units share the same versions?

     

    If not, how can I verify which versions are loaded on the passive unit?

    localhost
    localhostAnswer
    Visitor III
    April 24, 2020

    You can compare ISDB versions with:

     

    #diag autoupdate versions

     

     

    Terms & ConditionsAccessibility statement