Fortigate HA out of sync after upgrading to version 7.4.9

[Kyra_98]

Hi!

I recently updated the firmware of a FortiGate 200F from version 7.2.11 to 7.4.9 and the HA did not finish synchronizing.

There are 2 tables out of sync:

1. system.central-management
2. firewall.internet-service-name

Any ideas to solve it?

[yderek]

@Kyra_98  

run below command on both firewalls 

#diag sys ha checksum recalculate

If still showing not synced , get below output and attach to here on both firewall 

get sys status 

show sys central-management

show firewall internet-service-name

Follow this KB how to access the secondary from primary to run the commands 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-access-the-secondary-unit-from-the-...

[AEK]

Additionally to Derek's advice, I usually get it solved quickly just by rebooting the passive node. This usually works.

[Kyra_98]

@yderek @AEK 

Thanks for your responses.

I ran the command:
#diag sys ha checksum recalculate

And the secondary firewall was also restarted, but it still won't sync with HA.

I'm sharing the output from the commands provided.

FG_PRIMARY 

FG_SECONDARY 

[yderek]

@Kyra_98  Can you login to secondary device and try to added the below part manually first 

config sys central-management 

set vdom 'vsys_hamgmt'

end 

set vdom 'vsys_hamgmt' --this is the command that is missing from the secondary for the central management part 

This is bit strange as vsys_hamgmt will be the hidden vdom system created for your device automaticlly once you have a dedicated management interface enabled for OOB 

Let's see whether above will fix the first table, we come back to your ISDB name mismatch will be require bit troubleshooting 

[Kyra_98]

I try to run the indicated command but I get the message "entry not found in datasource"

FG_SECONDARY (central-management) # set vdom vsys_hamgmt
entry not found in datasource

value parse error before 'vsys_hamgmt'
Command fail. Return code -3

[Kyra_98]

I ended up setting "set vdom root" to fix that table and so far it's fine.

But the problem with ISDB remains.

[yderek]

@Kyra_98  Nice to hear that fixed the table of central management 

For your ISDB one, I think we might need to give a kick for pulling  FortiGuard update from secondary device 

Check whether you have proper connection from secondary for FortiGuard 

Login secondary devie ( I believe you should have GUI access) 

Open CLI and execute below 

exe enter vsys_hamgmt ( not support tab key, type manually) 

get router info routing-table all ( you should only see  1 single route here) 

exe ping update.fortiguard.net 

exe ping service.fortiguard.net

After you made sure you getting proper ping reply from above 

Type 

exit ( to exit the hiddent vdom) 

Run below command 

exe update-now 

Wait for 1-2 minutes and do the HA recalculate on your primary and secondary see whether that will fix