Skip to main content
yasushiazami
Visitor III
June 9, 2026
Question

In an HA configuration, the status of "config firewall ssh local-key" differs between the Primary and Secondary servers.

  • June 9, 2026
  • 3 replies
  • 66 views

FG-80FでHA構成を構築したが、「config firewall ssh local-key」の状態がPrimaryとSecondaryで異なるのはなんで??

 

#Primary

config firewall ssh local-key
    edit "Fortinet_SSH_RSA2048"
        set password ENC AAAAELE8NqYyMBgEhQ7grTfXnpgDb0j1zQrGm/aSSQ1sqReRT3VeDXYDl6GmJTfjifhoYZqMV94zwzYt3BI8Li3/XhV3YaPXywj7lf2VBcKfDSbZbTvJO/8fw2pN25HAxq6I4/cd3ZX90abcxiEdz3oQ1adKVpy/75tzDx95iKJ04o6uTMByeivFhMvKizbm2xAEE1lmMjY3dkVA
        unset private-key
        unset public-key
        set source built-in
    next

 

#Secondary

config firewall ssh local-key
    edit "Fortinet_SSH_RSA2048"
        set password ENC AAAAELE8NqYyMBgEhQ7grTfXnpgDb0j1zQrGm/aSSQ1sqReRT3VeDXYDl6GmJTfjifhoYZqMV94zwzYt3BI8Li3/XhVKqNqqBKwoZqTJvhlyp3Zj30tjCJrI4bRFjiacIgfgGLajHp73E3BtG700kjxkxzUMlTFHFg7OPISbONaK1IoYVL17IOcl6QzL6wR9NJMnLVlmMjY3dkVA
        set private-key "-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCEPyKnpO
C7AuAUn8wkg717AAAAEAAAAAEAAAEXAAAAB3NzaC1yc2EAAAADAQABAAABAQC37dLSRQBZ
oOb49bsDn/YVhLuGlHio5XLLl9DzyWWbLZeEAlhln70mweR/Yr6mILLg9q8AvVtO6tKTiZ
NvkgjVUmTbIS/Frlkf9sL8SKXXILWViGvtp8n72c1911PD/8zKVZcyBoAuGMsibBnG8VrU
5qkAc2BUYwAylaR1fKs2i0v8qvMgGuj3DKTkOXwvI2Bu41A1Mf+opasfl3T3OFSffm2og/
51c8i0Ef3KR7E0xlR0s0edAaBcjHPSZ71KdFgvUrzVPncI4+FC7GsHeb5Uk8wJEvrBv6Ap
apPe/u//sSK00v3/9YvutEgykxYFzQyjp4esTUeiy67oX2tyqtkTAAADwHnWGD33lj59Im
HWwZxZselnh6p6rBlwva/QCcUJEIlky4+HCR2MMfXa9rm4TbtLYk6LgCKlzO5h5Jn7bUDI
sV/LRYFPX/r9XC1HqwQbpP0+oRV50IYOxiXhgvBewHiQxWZ+29VBcjYxDPKU2jbznsv8WT
/IlGhqSGIVPmWRqcob3C7dQtXWntzTZd05b5EII5gbCC3Sh3WO4kOMkg+3D7ZCLkRpCPLT
Irfss2P6yAo5fb/CuTluGM43GqGCSLKZPwGlhImaqjSzr7jTZUyHRenqtnj2ZzcUYLcuOQ
qitWFeIPueO7MU4vhuRCxzSutoPat/rRbBlvl33Uq7H/fW4YtWyWdkLpOZb8ZBZG93m+AD
VToaeUgdmWhOLa4bXT5k2qqAOb2RLmdf9OFN4Wij44iACpwCv7OivtaHxbtysmeH7f79vd
oyw9cFGCaFtZeIgnTy/BoiKtKwzX8TNImtM+e4pM/7xIkiSumM8aq3a/KLtqfwXvpCbvuG
dhdmMgsEQf/FX99xSLnKVw40OUEEk71vz6vx5pPdKP32Nb2ltF5visYX9L4yLs35Amm/AX
br5t8spsDcyOnPIi0n3XrZrGgq60++MhnalAI9LTu2hrcVY1G/SvWs+n2KUUof8qWHxrta
q88nemY3mwOWN3IVnr3BmPv+cy2rnf6aOc29wU2IB/kzDrzUDDCLbOIzZP35EEyOVmsJB8
IyBpB5dsKL2QBS7q1/LPjcf6oUZ8pKduqrYnjWOvLj/LREV/PW4oFIhLJmCvwu7EvwvsVB
NaGLbGSSCqUPjZ38m9RwNL1GFbGEMmq62xkxvbDJfidCBA7QAg0mlkfgJ2eACXW1aM3YnA
gX3/VEceSi4i/8fAHyo9snA7uYjhg1x5kvyvoHcrJYZRr5NKoqU0zVEPBzZzCsFLCRmUEC
FozMWVaUL94S+0HIefAJLY0jLIBpd8hYJHeDXA/w9mo1BvxTt4XK3TEKcHlhvku6EUxXHG
znWkcz5o3tR6bEQtmY4apatAqikJGkAlAdEDd0MLJqfxNCLuM0WsZxlCMlffGDc9pkOT/Z
PmgjrrafK56JLNpB3bWakXfJYdJ1TfAbd7ooDXXxA01YvPs70LWHwojR8HcBrcyStCyqAw
HqEh4+uP7q/nM+jDzHfYegvp4sjejcFl81sE6O7dUHa7bva2delwHghzhP1w+z/8IGj9jf
ES6vOJ5397VUbOx3bUkqMVS/Y3cYAi9uuDjtQVIdUwyZDMdda5amKN32wvVSNHYNGYyBjz
JzgHAUug==
-----END OPENSSH PRIVATE KEY-----
"
        set public-key "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC37dLSRQBZoOb49bsDn/YVhLuGlHio5XLLl9DzyWWbLZeEAlhln70mweR/Yr6mILLg9q8AvVtO6tKTiZNvkgjVUmTbIS/Frlkf9sL8SKXXILWViGvtp8n72c1911PD/8zKVZcyBoAuGMsibBnG8VrU5qkAc2BUYwAylaR1fKs2i0v8qvMgGuj3DKTkOXwvI2Bu41A1Mf+opasfl3T3OFSffm2og/51c8i0Ef3KR7E0xlR0s0edAaBcjHPSZ71KdFgvUrzVPncI4+FC7GsHeb5Uk8wJEvrBv6ApapPe/u//sSK00v3/9YvutEgykxYFzQyjp4esTUeiy67oX2tyqtkT"
        set source built-in
    next

 

3 replies

Jean-Philippe_P
Staff & Editor
Staff & Editor
June 12, 2026

Hello yasushiazami, 

 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

 

Regards,

Jean-Philippe - Fortinet Community Team
msanjaypadma
Staff
Staff
June 12, 2026

 Hi ​@yasushiazami ,

This seems to be known issue with HA cluster not syncing for SSH host-key local-key .

Could you confirm what is FortiGate FortiOS are you running ? and its fixed in v7.6.6

As workaround can you configure the ssh host/local-key manually on the Primary firewall of the HA cluster

Thanks,

Mayur Padma

Thanks, Mayur Padma
Visitor III
June 12, 2026

Generally secondary unit get the SSH key from the active unit. And ensure that you configure the management interface properly and probably you can sync the confg to secondary and see.

 

Thanks