90G 7.2.9 update on HA pair only updating secondary

[nanduu]

I have been slowly rolling out 7.2.9 to our 90G Fortigates, and I have noticed consistently that in our HA pair configurations the update will install on the secondary then fail on the primary and I have to reboot the primary then push the update again and it finally goes through. This has happened on 3 different pairs. Has anyone else seen this issue?

[kaman]

Hello Nanduu,

When updating firmware in an HA pair configuration, it is common for the update to be installed on the secondary FortiGate first before failing on the primary FortiGate due to the following reasons:

1. **Sync Issue**: Sometimes, there might be synchronization issues between the primary and secondary FortiGates, causing the update to fail on the primary FortiGate after being successfully installed on the secondary.

2. **Resource Conflict**: The primary FortiGate might be handling more traffic or processes, leading to resource conflicts during the update process, resulting in a failure.

3. **Configuration Mismatch**: If there are differences in configurations between the primary and secondary FortiGates, it can cause the update to fail on the primary FortiGate.

To address this issue, you can try the following steps:

1. **Check Synchronization**: Ensure that the primary and secondary FortiGates are properly synchronized before initiating the update process.

2. **Verify Resources**: Make sure that the primary FortiGate has enough resources available to handle the update process without conflicts.

3. **Configuration Consistency**: Verify that the configurations on both FortiGates are consistent to prevent any update failures due to configuration mismatches.

Also, please refer to the below document to fix an HA (High Availability) cluster upgrade failure:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Fix-an-HA-High-Availability-cluster-...

[Secucard]

Yes

Re: FortiOS 7.2.9 for 120G series seems to break H... - Fortinet Community

Same here, update stuck on slave, and then primary was on old version, we never got it fixed or working, always, HA interface on a 120G seems to be missing ...