out-of-sync between primary firewall and secondary firewall

i would first try to identify exactly what is going out of sync before forcing another synchronization.

if you check system > ha in the gui, the out-of-sync member should show which configuration table or object has a checksum mismatch.

from cli you can also run:

diagnose sys ha checksum cluster

if it keeps happening again after support gets it back in sync, i would capture the exact object that is different and share that with tac. that will be much more useful than just forcing another sync, because something specific is probably changing or failing to synchronize.

you can also try recalculating the checksum and then forcing a sync:

diagnose sys ha checksum recalculate 

execute ha synchronize start

fortinet troubleshooting:
https://community.fortinet.com/fortigate-3/technical-tip-troubleshooting-a-checksum-mismatch-in-a-fortigate-ha-cluster-99096

manual sync:
https://community.fortinet.com/fortigate-3/technical-tip-procedure-for-manual-synchronization-for-ha-out-of-sync-issue-97844

no change 

Duplicate:

Team

I have configure SDWAN on the network, just about 2 hr one of the ISP want down, but i wa SDWAN to switch the traffic to other ISP, which it did happen, however some end user lost connectivity to the internet what commend can i used to generate a log which will help me what was the problem or the issues, i want if its routing or SDWAN LSA 

Here's a polished rewrite of your message:

We have SD-WAN configured on the network. Approximately two hours ago, one of our ISP connections went down. SD-WAN successfully failed traffic over to the secondary ISP as expected. However, some end users still experienced a loss of Internet connectivity during the failover.

I would like to determine the root cause of the disruption. Specifically, I want to identify whether the issue was related to:

• SD-WAN SLA health checks or failover behavior
• Routing convergence or route changes
• Session drops during failover
• Issues with the secondary ISP after the failover

Is there a FortiGate CLI command or log filter that I can use to review events from the outage window and help identify why users lost connectivity even though SD-WAN successfully redirected traffic to the backup ISP?