FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
ManoelMartins
Article Id 269924
Description

This article describes how to fix an issue where HA is out of sync and it becomes impossible to manually change the config in both units of the HA setup.

Scope

FortiOS 7.0.12.

Solution

Occasionally, a sync error arises with the system.custom-language object as shown below:

 

diagnose debug config-error-log read
>>> "set" "filename" "en" @ global.system.custom-language.en:value parse error (error -651)
>>> "set" "filename" "fr" @ global.system.custom-language.fr:value parse error (error -651)
>>> "set" "filename" "sp" @ global.system.custom-language.sp:value parse error (error -651)
>>> "set" "filename" "pg" @ global.system.custom-language.pg:value parse error (error -651)
>>> "set" "filename" "x-sjis" @ global.system.custom-language.x-sjis:value parse error (error -651)
>>> "set" "filename" "big5" @ global.system.custom-language.big5:value parse error (error -651)
>>> "set" "filename" "GB2312" @ global.system.custom-language.GB2312:value parse error (error -651)
>>> "set" "filename" "euc-kr" @ global.system.custom-language.euc-kr:value parse error (error -651)

 

When this error occurs, a manual change also fails:

 

config system custom-language

edit tx-sjis

unset filename

end

 

Invalid file.

node_check_object fail! for filename

Attribute 'filename' MUST be set.

Command fail. Return code -651

 

To resolve the issue:

 

  1. Execute a failover to the secondary (this step usually fixes the issue).
  2. Force a recalculate operation through the CLI:

diag sys ha checksum recalculate

 

  1. Execute a failover back to the primary.

 

If these steps do not resolve the issue, contact Fortinet's TAC team for additional support.

 

Related article: