How to create a HA cluster for a FortiGate 60F - Running into issues when building one
Got a site which has a FortiGate 60F with a configuration which we would like to enhance by adding a secondary FortiGate 60F in an active-passive cluster. Main goal here is to leave the site up-and-running while performing a firmware update or something of the sort. The FortiOS active (at present) is 7.0.13. So I found this: https://docs.fortinet.com/document/fortigate/7.0.13/administration-guide/900885
Seems pretty straight forward, but rather than dive in head first on site, I figured... I have two spare FortiGates and a Fortiswitch, so I can just build a testcase and see what happens. Not that we're playing with an HA cluster anyday, so we'd rather make sure I have a reproducable result before trying it in the liver environment. So did just that, and while I needed to accomodate for the test environment (by authorizing the switch and adding a couple of VLANs to facilitate the topology), I managed to get the existing (non HA FortiGate) situation up and running with a copy of the existing configuration on a desk.
So following the procedure, made the connections, used ports 2 and 4 as the heartbeat on the existing FortiGate and factory reset the second FortiGate. Once up I removed port 2 and 4 from the 'Internal' group, and dropped into the HA menu. Set the exact same thing just with a higher priority number (trying to force the active member to be the primary and thus retain the configuration).
Once the secondary unit came back it was complaining about not being in sync and we could see the checksums were inconsistent. Leaving it for 30 minutes didn't seem to eventually resolve it tho.
Next workday, we made the primary unit standalone again, and factory reset the second unit and tried again. Toying a bit with the priority setting, but with pretty much the same result. The system is complaining about 27 to 29 tables being out of sync, which doesn't make much sense to me, seeing the factory reset device should have grabbed the whole configuration (less than 1 MB) on joining the cluster. We left it during the night, and apparently it corrected itself eventually (unsure what it does in the sync part, so also unsure why that would take that long), tho that may have been a fluke.
When manually checking the configs we found differences between the two which seemed mostly to be focused on ordering... So where one configh had three objects in order 123, the second unit would have the same objects but in order 132 for instance.
Then today my colleague redid the whole thing from scratch. Factory reset both FortiGates, redownloaded the configuration from the active onsite unit, uploaded that to the primary unit and created the caveats needed to facilitate the test-environment. Then did a factory reset on the second unit again, made the alterations for the heartbeat ports by excluding them from the internal interface group, and joined the cluster (in this case using the same priority on both FortiGates). Which again was then complaining about not being in sync... However this time round we found that the FortiGate with no config which was supposed to join apparently decided it was the master, and thus wiped the entire config on the other unit (which had the active config for the site).
Retried again, but just making the priority of the second unit higher, and still no dice... So we only got an insync HA cluster once out of the 4 times we tried. Not good odds to go onsite and just pray it'll work as required there.
We're looking for any insight in how to either:
1) Designate which configuration from the two HA units is the one that should be retained
2) Force push the configuration in it's entirety to the fellow HA member, thus forcing a full sync between the two.
3) Any expiriences with HA clusters on FortiGates that may indicate we're missing something or what we could do better.
The provided URL is rather brief on how the process works, and doesn't hint on the issues that arise when actually doing the procedure, The ins-and-outs of the process seem to be a lot more involved than the overview seems to suggest.
As it is, I'm not feeling too confident to go onsite and just add the second FortiGate, then hope and pray all goes well...