Troubleshooting Tip: FortiAnalyzer HA could not be performed with specific error message 'Firmware version mismatch'

[HernandezA]

Description	This article describes how to perform a troubleshooting process when a FortiAnalyzer HA could not be performed with a specific error message 'Firmware version mismatch'.
Scope	Fortianalyzer.
Solution	Pre-requisites: Define HA topology and IP addressing. Steps: Validate the current issue scope and error message. In this case, the HA cannot be created, and configuration cannot be synchronized in a HA topology with Active-Active roles where FAZ01 must have the primary roles and FAZ02 must have the secondary roles. HA status in FAZ01. HA status in FAZ02: Confirm the exact error message that is related with the version mismatch. Confirm the current version in each FortiAnalyzer node, either using the CLI (get system status) or the GUI. The current version is in FAZ01.       Current version in FAZ02. In this example, the presence of different versions was confirmed. It is therefore necessary to upgrade match versions, best scenario go to most recent version. (can refer to following link to upgrade process) Upgrading FortiAnalyzer Firmware - Fortinet Community. After an upgrade, the status remains in deploying and cannot be synchronized. We proceeded to verify configurations in HA parameters to identify some mismatch. HA Parameters in FAZ01. HA parameters in FAZ02. The main configuration for HA according to topology design is correct using the VRRP, group, password, and heartbeat interfaces. After a while, the synchronization was not performed. In this experiment, the HA status was validated in both sides and it was identified that both had the same priority. FAZ01 HA status: FAZ02 HA status: It is necessary to change the priority to FAZ01 to make the HA start up and synchronize. Verified synchronization was completed and HA came up, but the roles were not taken correctly. In this case, the FAZ01 was marked as secondary, which does not suit the intended design. HA status in FAZ01. HA Status in FAZ02.              It was necessary to perform a failover of the HA due to having already confirmed the priority is higher in FAZ01, and the role was selected as primary. Consequently, a recalculation of the HA must be performed. To perform the failover, the following command was used in FAZ01.       After performing a failover, it was possible to confirm the roles were correctly assigned according to design, and the configuration was synchronized. HA main status in GUI. HA Status in FAZ01. HA status in FAZ02.   Related articles: Technical Tip: FortiAnalyzer HA Configuration and Troubleshooting

[cmartinez1]

Thanks for the information, it was very helpful.