Troubleshooting Tip: Backup & Restore Cluster HA when there are many differences in tables

[pabarro]

Description	This article describes how to recover synchronization in the HA cluster when there are too many checksum differences between different tables.
Scope	FortiGate up to 3K v6.0 up to v7.6.
Solution	For test purposes, FortiGate-500E v7.0.15, build0566, 231024 is used. Confirm in both FortiGates if the override is disabled as follows: show full sys ha Confirm the hostname and serials in both FortiGates as follows: get system status In a summary the collected information is as follows: Hostname: Fortigate-A FG-SERIALXXX_A Primary Priority 200 FortiGate-500E v7.0.15,build0566,231024 (GA.M) Override disable Mode: Active - Pasive -------------------------- Hostaname: Fortigate-B FG-SERIALXXX_B Secondary Priority 100 FortiGate-500E v7.0.15,build0566,231024 (GA.M) Override disable Mode: Active - Passive Initial notes: A person must be on-site to be able to connect to the devices. Make a full backup of the Primary (FortiGate-A). Activity Summary: Currently, FortiGate-B has too many checksum differences between different tables and is out of Sync.  Perform a Restore on FortiGate-B. Load a Backup on FortiGate-B, edit it, add it to the cluster, and resynchronize the HA.  Procedure: Make a full backup of FortiGate-A (Active FortiGate with serial terminal FG-SERIALXXX_A). Disconnect (all cables) from the HA cluster the FortiGate-B. (Secondary FortiGate with serial terminal FG-SERIALXXX_B.) Leave only the FortiGate-A connected (Active FortiGate with serial terminal FG-SERIALXXX_A). This equipment will       remain operational to avoid service affectation. See Figure 1: Note: If the cables are not labeled, proceed to identify them to avoid confusion when reconnecting them later. Work with the FortiGate that is disconnected from the HA, that is, FortiGate-B (Hardware with the Serial number FG-SERIALXXX_B). Log in to the FortiGate-B via the management port and get connected to the GUI. The backup made in the step 1 file should be located in the PC connected to the FortiGate-B. Choose and Load the Backup made in Step 1 to this FortiGate-B: Once the backup is loaded, the FortiGate will reboot. Log back into the GUI and Edit the Hostname and basic HA configuration as follows:   Via GUI could be updated as follows: config system global     set hostname Fortigate-B end config system ha     set priority 100       <- Set the value to 100, originally 200. end                               <- Save the changes. Check from the CLI that the changes have been accepted: show full system global | grep hostname     <- FortiGate-B should be the hostname. show full system ha | grep priority            <- 100 should be the Priority. Once these configuration settings have been made and verification has been performed, physically connect the secondary device (FortiGate-B) to the HA cluster and wait for it to sync. See Figure 2:   If the units DO NOT sync, open a ticket with support and call support for immediate assistance. Refer to the below article for more information to troubleshoot checksum mismatch on HA clusters: Troubleshooting a checksum mismatch in a FortiGate HA cluster