Fortigate 240D cluster out of sync every time

[Ralph1973]

Hello,

One of our customers has a Fortigate 240d cluster with one unit in Datacenter A and one in Datacenter B. 

 Software is FortiOS 5.2.2

I have checked with commands

diag debug application hasync -1
diag debug application hatalk -1
diag debug enable

On the master I entered

execute ha synchronize start

diag sys ha status
diag sys ha showcsum
diag sys ha showcsum 1
diag sys ha showcsum 2
diag sys ha showcsum 3

The units get out of sync each time a number of (small) changes are made. 
Are there people familar with this issue, is it FortiOS5.2.2 related perhaps?

Kind regards,
Ralph Willemsen

[digimetrica]

Hello,

I have the same issue with 5.2.3 as well.

I just did (5 minutes ago) a rebuild and they ar out of sync, though the cluster is operational and changes are correctly propagated.

Waiting for next firmware upgrade (I won't go to 5.2.4 since I had other kind of problems with that firmware).

[torenhof]

Ralph1973 wrote:

Hello,

One of our customers has a Fortigate 240d cluster with one unit in Datacenter A and one in Datacenter B. 

 Software is FortiOS 5.2.2

I have checked with commands

diag debug application hasync -1
diag debug application hatalk -1
diag debug enable

On the master I entered

execute ha synchronize start

diag sys ha status
diag sys ha showcsum
diag sys ha showcsum 1
diag sys ha showcsum 2
diag sys ha showcsum 3

The units get out of sync each time a number of (small) changes are made. 
Are there people familar with this issue, is it FortiOS5.2.2 related perhaps?

Kind regards,
Ralph Willemsen

Hi,

I have recently encountered this behaviour on two 600C clusters.

Mails were flooding with in-sync and out-of-sync status in it.

It's 5.0 version patch 11

Together with FG support, we recalculated the checksums after manually recalculating them

diag sys ha csum-recalculate "vdom"

Messages stopped being sent afterwards.

On the other cluster, the problem isn't solved yet. Waiting for FG engineer to get in touch with me.

Regars

[Ralph1973]

Hello,

Until now I wasn't able to solve this. Maybe this will be solved in 5.2.5 or later...

In the meantime, the cluster works as expected and changes are written both to master as slave unit

With kind regards,

Ralph

[nicoco59]

Same issue here in 5.2.4. 

I did a lot of reboot, failover but the mails continues flooding regarding in-sync / out-of-sync. 

What is strange is that the object are synchronized between the cluster. 

Anyway, we'll see if the issue persists in 5.2.5...

Regards,

Nick

[ede_pfau]

The release notes for v5.2.5 mention this HA problem (as solved), have a look.

[Ralph1973]

Hello Ede, thanks for your answer. It is not entirely like that;

Debugzone mismatch keeps device out-of-sync even though all checksums are fully matched

The units look and behave like they are in sync, however the checksums do never match.

      GUI Bug ID Description 280995 Certain address objects cause rendering issues on Internet Explorer. 287913 js error on firewall address because the list cannot be displayed in GUI 262009 GUI does not show the correct information about the actual DDNS configuration used. 276941 No value is returned when accessing Virtual Switch interface's OIDs. High Availability Bug ID Description 286826 FortiGate does not send the certificate request when accessing via ha- mgmt- interface 268224 Email with a local report sent twice daily on FortiGate in HA mode. 285561 HA lost neighbour info and failover occurs after 497 days. 279280 init_ nids_ db: ips_ so_ open failed, ret=- 1 error messages on the console of the cluster slave. 288964 Debugzone mismatch keeps device out- of- sync even though all checksums are fully matched. 281439 FSSOD stops working on HA slave member. 283955 When HA failover occurs, the bfd neighbor disappears from the root

VDOM