- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HA out of sync due to vpn.certficiate.ca
Hello - I have a customer who updated to version 7.2.3 to be clear of the recent SSLVPN vulnerability; however, HA is out of sync and comparing out puts it is showing the vpn.certficiate.ca.
This shows to be a bug in an earlier version.
Any advice?
Thank you
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried recalculating the checksums of both HA nodes? That sometimes helps.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One of the first things I did on both units and no joy.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Team,
I understood the issue.
Can you please let me know if its in vdom environment. If its vdom environment in which vdom the HA sync not happening. Is it like in some vdom the certificate present and in some other certificate not present?
If its not in vdom environment, please execute this commnad in both firewalls:
#config vpn certificate ca
#show full
Compare both texts and let us know which certificate is mismatching
If you get to know which certificate is having the issue, please execute these commands and share us the output:
config vpn certificate ca
edit <cert-name>
show full
end
Please execute commands in both firewalls and share us the output
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Actually, it seems much simpler - the backup did not take the upgrade for some reason. So right now HA2 is at 7.2.3 and HA1 is at 7.2.2
The client will update HA1 after hours. Not really sure why it did not take since it is setup as HA.
7.2.3 is really new, maybe a hiccup in the code??
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
had the same happen to me on a 101F cluster - 7.0.14
For reference:
I got mismatches on system.central-management and certificate.ca - checking those showed absolutely identical. Then I ended up on this post - I ended up logging on to the fgt with lower version and upgraded from there manually again.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have the same problem here. Yesterday I updated from 7.0.14 to 7.2.8 on my active-passive cluster. An error was displayed during the update, but both firewalls were on version 7.2.8.
Now the cluster is no longer synchronized. The checksum of vpn.certificate.ca is different.
active Firewall:
#config vpn certificate ca
#show full
shows long list with all certificates
passive firewall:
#config vpn certificate ca
#show full
output:
#config vpn certificate ca
#end
but:
#edit "CommScope_Public_Trust_RSA_Root-02"
#show full
#config vpn certificate ca
# edit "CommScope_Public_Trust_RSA_Root-02"
# set ca "-----BEGIN CERTIFICATE-----
#xxxxxxx
#-----END CERTIFICATE-----"
# set range global
# set source bundle
# set ssl-inspection-trusted enable
# set scep-url ''
# set source-ip 0.0.0.0
# set ca-identifier ''
# set obsolete disable
# next
#end
The same for all other certificates. Looks like all certificates are there and the settings are all identical.
Does anyone have any ideas?
Thank you very much!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Carsten,
You could try to recalculate the checksum on primary and secondary. If that does not work, would you be able to reboot the units?
Anthony.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just experienced this issue while upgrading from 7.0.15 to 7.2.9.
Recalculation of checksums and manual HA syncs didn't help.
A reboot of both cluster-members finally fixed it.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
an update from 7.2.8 to 7.2.9 has not changed anything. Failover during the update process went without problems. Since only one certificate was not synchronized, I ignored the problem. And all other changes in the configuration were synchronized immediately.
An update from 7.2.9 to 7.2.10 solved the problem without any further action.
With best regards
Carsten
![](/skins/images/314F488D15A2016126B094729A0E57E8/responsive_peak/images/icon_anonymous_message.png)