FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Juancacst
Staff
Staff
Article Id 408841
Description This article describes how to verify that HSync is writing to the secondary.
Scope FortiGate v7.2, v7.4, v7.6
Solution

The hasync process is responsible for synchronizing all configuration from the Primary to the secondary cluster member. The following debug commands can be enabled for troubleshooting to display write requests from HASYNC to CMDBSVR, as well as object modifications via the CLI.

 

  1. Enable the debug commands below on the secondary HA unit:

 

diagnose debug reset

diagnose debug console timestamp enable

diagnose debug cli 7

diagnose debug cmdb-trace 1

diagnose debug enable

  1. On the primary’s GUI, create, delete, or update an object, and save the changes.
  2. Review the diagnostics on the secondary.

Example output after creating an address object 'New_Object' on the primary. The bolded output is from the CLI debug, while the non-bolded output is from the cmdbsvr debug:

 

0: config firewall address
cmdbsvr recv req_type=2(CMDB_REQ_INSERT) from pid=207(/bin/hasync)
[_svr_d_insert:2686] pid=207(/bin/hasync), object='firewall.address'
0: edit New_Object
0: set uuid a7a06ffc-85e2-51f0-7c39-d9067e5d9fc4
0: set subnet 1.2.3.4 255.255.255.255
cmdbsvr recv req_type=5(CMDB_REQ_CLEAR) from pid=207(/bin/hasync)
[_svr_d_clear:2746] pid=207(/bin/hasync), object='firewall.address.fsso-group'
cmdbsvr recv req_type=0(CMDB_REQ_COMMIT) from pid=207(/bin/hasync)
[_svr_d_commit:2664] pid=207(/bin/hasync), object='firewall.address'
cmdbsvr recv req_type=22(CMDB_REQ_SEND_CMDB_EVENT) from pid=207(/bin/hasync)
0: end
cmdbsvr recv req_type=21(CMDB_REQ_WRITE_CONFIG) from pid=207(/bin/hasync)
cmdbsvr recv req_type=21(CMDB_REQ_WRITE_CONFIG) from pid=207(/bin/hasync)
0: diag sys ha checksum show
cmdbsvr vd_set_inet_svc6_prio_id: vdom='root'
cmdbsvr send_event
cmdbsvr has savelist, nCfg_pushconfig2fmg=0
flash: block_sz=4096, free_blocks=20292


Example output after deleting 'New_Object' on the primary:

 

0: config firewall address
cmdbsvr recv req_type=6(CMDB_REQ_SETFLAG) from pid=207(/bin/hasync)
cmdbsvr recv req_type=5(CMDB_REQ_CLEAR) from pid=207(/bin/hasync)
[_svr_d_clear:2746] pid=207(/bin/hasync), object='firewall.address.macaddr'
cmdbsvr recv req_type=5(CMDB_REQ_CLEAR) from pid=207(/bin/hasync)
[_svr_d_clear:2746] pid=207(/bin/hasync), object='firewall.address.fsso-group'
cmdbsvr recv req_type=11(CMDB_REQ_CLI_CLEAR) from pid=207(/bin/hasync)
cmdbsvr recv req_type=5(CMDB_REQ_CLEAR) from pid=207(/bin/hasync)
[_svr_d_clear:2746] pid=207(/bin/hasync), object='firewall.address.tagging'
cmdbsvr recv req_type=6(CMDB_REQ_SETFLAG) from pid=207(/bin/hasync)
cmdbsvr recv req_type=3(CMDB_REQ_DELETE) from pid=207(/bin/hasync)
[_svr_d_delete:2707] pid=207(/bin/hasync), object='firewall.address'
cmdbsvr recv req_type=22(CMDB_REQ_SEND_CMDB_EVENT) from pid=207(/bin/hasync)
0: delete New_Object
0: end
cmdbsvr recv req_type=21(CMDB_REQ_WRITE_CONFIG) from pid=207(/bin/hasync)
cmdbsvr recv req_type=21(CMDB_REQ_WRITE_CONFIG) from pid=207(/bin/hasync)
cmdbsvr vd_set_inet_svc6_prio_id: vdom='root'
cmdbsvr send_event
cmdbsvr has savelist, nCfg_pushconfig2fmg=0
flash: block_sz=4096, free_blocks=20292
0: diag sys ha checksum show

  1. Disable and reset the debugs on the secondary:

 

diagnose debug disable

diagnose debug reset