Troubleshooting Tip: HA out of synchronization 'application.list' mismatch

[Shashwati]

Description	This article discusses the issue of HA out of synchronization.
Scope	FortiGate v6.X and v7.X.
Solution	Check System -> HA. If the HA secondary device shows as 'Not synchronized', hover the mouse on the Status:   It will show the configuration information which is different between the Primary and Secondary Firewall. The above picture shows that the Application list was mismatched between the HA pair. The information seen from GUI should be validated via CLI and compared as follows (sometimes is a false out-sync). diagnose sys ha checksum show <vdom_name> <object_name> Example:  diagnose sys ha checksum show root application.list (In both FortiGates of the cluster.) If there is no difference between the checksum for that application.list, the cluster HA can be Sync as follows: diagnose sys ha checksum recalculate <----- Execute on each FortiGate 4-5 times In parallel. If there is a difference between the checksum for that application.list check via 'config application list'. Edit the configuration on the secondary Firewall to match with Primary. The HA pair will be synchronized again. Alternatively, the below commands can be used to restart the HA process: fnsysctl killall hatalk fnsysctl killall hasync Related articles: Troubleshooting Tip: HA synchronization issue, cluster out of sync Technical Tip: Procedure for HA manual synchronization Technical Tip: FortiGate cluster out of sync due to 'application.list' Technical Tip: Correcting an out-of-sync HA cluster by modifying the primary unit configuration file....