Technical Tip: An alternative way to recover HA Sync

[jdelafuente_FTNT]

Description

This article describes an alternative way to recover HA Sync Status in a FortiGate Cluster, using a backup configuration file modified.

Scope

FortiGate, Cluster, HA.

Solution

Sometimes, the HA cluster goes into the un-sync mode, due to a non-modifiable configurations, (for example a UUID or system objects).

This method helps to solve.

Prerequisites:

• Physical access to the cluster.
•  Serial console cable.
•  Identify ports and cables connected (label if needed).
•  Super admin account credentials, IP, and port for management.

Preparation of modified file:

• Access to the current primary FortiGate GUI and download a configuration file backup.
• Access to current secondary Fortigate CLI and take note of the following configurations:

show system global <----- Hostname and alias.

show system ha<----- Priority, Management and override status*.

show system interface "interface_name" <----- All management interfaces.

• Open Primary's configuration file with a text editor (notepad++), replace all the above configurations for Secondary unit, and save it as a new file.

Procedure:

1.  Connect to the secondary FortiGate using a serial console cable.**
2.  Execute command and confirm command:

execute factoryreset

•  While restarting, disconnect network cables from the Fw-Slave (Optional***).

3.  Configure the laptop ethernet IP with 192.168.1.20/255.255.255.0 no gateway neither DNS is needed.
4. Connect the ethernet cable between the laptop and the default management port of FortiGate. (mgmt or port1, may vary depending of the model).
5. Access to the secondary FortiGate GUI with default values:

https://192.168.1.99

user: admin

password: blank

6. Restore the configuration using the modified backup file.
7.  If possible, keep connected to the wireless network and access cluster GUI to check HA status.

• Once rebooted, change the laptop's NIC address, connect to internal, and validate the hostname, and HA priority. (Optional, only 2.1) has been followed).
• Turn off Fw-Slave again, reconnect cables, and power on. (Optional, only if 2.1) has been followed).

8. After a few minutes, the cluster should show up and be in sync.

Important notes:

* If override is enabled be sure priority in secondary is slower than primary.

** Can use SSH but be careful to change between primary and secondary administration.

*** It is always better to recover and validate configurations before rebuilding HA.