Skip to main content
Zato02
Zato02
Explorer II
August 30, 2025
Question

HA sync breaks after upgrading Fortigate 200F from 7.0.5 to 7.2.2.

  • August 30, 2025
  • 1 reply
  • 1204 views

After upgrading the firmware of a Fortigate 200F in an HA configuration from 7.0.5 to 7.2.2, the HA synchronization was lost. Ideally, we would like to upgrade all the way to version 7.4.3. Please advise on how to resolve the issue if synchronization breaks, and whether there is an upgrade path that avoids this problem.

1 reply

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
August 30, 2025

A general answer would be you need to follow the steps in a KB:
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-troubleshoot-HA-synchronization-issue/ta-p/193422
Then find out what part of config is not syncing on the secondary, then compare (diff) that part of config between the primary's and the secondary's. 


But before that, did you run "diagnose debug config-error-log read" described in the KB to check any problems happened during the upgrade on both units when each finished upgrading to 7.2.2? That command's output would tell quite a lot about trouble in config conversion, which likely caused the sync problem after upgrade.

However, I generally don't trust upgrading FGT through those earlier versions, like 7.2.2F, 7.2.3F... those might have potential problems. I wouldn't target like 7.4.3F either while the latest 7.4.8M is available. I would recommend upgrading the cluster to like 7.0.13M first, so that the big jumps 7.0.x->7.2.x and 7.2.x->7.4.x wouldn't have to go through those lower F(feature release) versions.
FOSversions.png

 

 Toshi

    Zato02
    Zato02Author
    Explorer II
    September 2, 2025

    Thank you very much for your advice.
    Based on your guidance, I would like to first change the milestone for the firmware upgrade.
    While I strongly prefer to set it to 7.4.8M as you suggested, unfortunately, due to instructions from another organization, we have to use 7.4.3F.

    Additionally, according to your advice, it would be better to perform "diagnose debug config-error-log read" before and after each firmware upgrade to verify that there are no issues, and to make minor adjustments if problems are found. Is my understanding correct?

    I apologize for my beginner's question, but is it possible to run "diagnose debug config-error-log read" while the system is operational?

    Thank you in advance.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    September 2, 2025

    Only after each unit finishes upgrade and you see "login:" prompt at the console, you should get in and run "diag debug config-error-log read". a-p HA upgrades always start with the secondary upgrade, then when it finishes the upgrade, or the primary recognize the secondary finished the upgrade, they swap the primary-secondary roles then the previous primary starts upgrading itself. If you keep console connected on both units, you would see the process.
    We use terminal servers to get to all HA pair's console ports remotely. Then as soon as I get the login prompt, the secondary(new or temp primary) first then the primary (previous) next, I get in and check the errors. Obviously at that time the unit is operational.

    Toshi 

      Terms & ConditionsAccessibility statement