FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
jjahanshahi
Staff
Staff
Article Id 193683

Description

 

This article lists the debugs that should be collected when troubleshooting HA issues.

Scope
 
FortiGate.


Solution

 

  1. The following debugs should be collected for any HA-related issues:

 

diagnose debug enable

diagnose debug console timestamp enable

diagnose debug application hatalk -1   <----- HA formation issues

diagnose debug application hasync -1   <----- HA Sync issues.

 

  1. Run the following on both Primary/Secondary units and collect the info:

 

get system performance status

get system status
get system ha status
diagnose sys ha status
diagnose sys ha history read
diagnose debug crashlog read
diagnose sys ha showcsum
execute ha synchro start
execute ha manage 0 or 1 <----- This command will switch from CLI of the Primary to Secondary.
diagnose sys ha showcsum
diagnose sys ha dump 5

 

  1. Packet captures for seeing communication between HA ports:

 

diagnose hardware device nic <heart beats interface>
diagnose sniffer packet port_ha "" 4    <---port_ha should be the heart beats interface.

 

  1. Collect the FortiGate’s HA and System EVENT logs for both units downloaded from the GUI/FortiAnalyzer or syslog (remote) server.

 

Related articles:
Technical Tip: Procedure for HA manual synchronization

Technical Tip: Rebuilding an HA cluster