Troubleshooting Tip: FortiGate in an HA configuration goes out of synchronization due to a split-port interface on FortiSwitch

[kaurg_FTNT]

Description	The article discusses the issue of out-sync HA after upgrading to v7.2.6 and v7.4.4.
Scope	FortiGate v7.2, v7.4.
Solution	After upgrading to FortiOS v7.2.6 or v7.4.4, synchronization issue occurs in High Availability (HA) setups. The problem is identified as a checksum mismatch related to split-port interfaces on managed FortiSwitches. Checksum calculation shows a mismatch with the split-port interfaces on managed FortiSwitch. The difference in the checksum is attributed to a different orders of command 'set fec-capable'. Sample config. Primary Firewall Configuration: Secondary Firewall Configuration: There is no workaround. Therefore, it is recommended to disable split-port on FortiSwitches. The issue is resolved in v7.2.10, v7.4.5 and v7.6.0.