Troubleshooting Tip: HA out-of-sync fix firmware mismatch issue without breaking cluster

[dbhavsar]

Description	This article describes how to fix the HA sync issues without breaking the cluster when both units are on different firmware.
Scope	FortiGate
Solution	The primary device must be the one with a higher firmware version. Once it is possible to access Primary FortiGate, log in to the CLI of the secondary unit with the commands outlined in Technical Tip: Managing individual cluster units with the CLI command 'execute ha manage'. View the current version of the secondary FortiGate with the following command: get system status Version: FortiGate-40F v7.4.8,build2795,250523 (GA.M) ... Configure the  TFTP server and load the image file in the directory (the image with the .out version should be the same as the primary) by using the below command to restore the image file: execute restore image tftp <file_name.out> <tftp server ip-address> <username> <password> Related document: execute restore - FortiADC CLI reference Once uploaded, wait for a while, HA will be in-sync or run the below commands on both units: diagnose sys ha checksum recalculate Related article: Technical Tip: Procedure for HA manual synchronization