HA out of sync due to vpn.certficiate.ca

[bigkeoni64]

Hello - I have a customer who updated to version 7.2.3 to be clear of the recent SSLVPN vulnerability; however, HA is out of sync and comparing out puts it is showing the vpn.certficiate.ca.

This shows to be a bug in an earlier version.

Any advice?

Thank you

[FredPaul]

Have you tried recalculating the checksums of both HA nodes? That sometimes helps.

[bigkeoni64]

One of the first things I did on both units and no joy.

[seshuganesh]

Hi Team,

I understood the issue.

Can you please let me know if its in vdom environment. If its vdom environment in which vdom the HA sync not happening. Is it like in some vdom the certificate present and in some other certificate not present?
If its not in vdom environment, please execute this commnad in both firewalls:

#config vpn certificate ca

#show full

Compare both texts and let us know which certificate is mismatching

If you get to know which certificate is having the issue, please execute these commands and share us the output:

config vpn certificate ca

edit <cert-name>

show full

end

Please execute commands in both firewalls and share us the output

[bigkeoni64]

Actually, it seems much simpler - the backup did not take the upgrade for some reason. So right now HA2 is at 7.2.3 and HA1 is at 7.2.2

The client will update HA1 after hours. Not really sure why it did not take since it is setup as HA.

7.2.3 is really new, maybe a hiccup in the code??

[LKA]

had the same happen to me on a 101F cluster - 7.0.14

For reference:

I got mismatches on system.central-management and certificate.ca - checking those showed absolutely identical. Then I ended up on this post - I ended up logging on to the fgt with lower version and upgraded from there manually again.

[Carsten]

Hello,
I have the same problem here. Yesterday I updated from 7.0.14 to 7.2.8 on my active-passive cluster. An error was displayed during the update, but both firewalls were on version 7.2.8.
Now the cluster is no longer synchronized. The checksum of vpn.certificate.ca is different.

active Firewall:
#config vpn certificate ca
#show full
shows long list with all certificates

passive firewall:
#config vpn certificate ca
#show full

output:
#config vpn certificate ca
#end

but:

#edit "CommScope_Public_Trust_RSA_Root-02"
#show full
#config vpn certificate ca
# edit "CommScope_Public_Trust_RSA_Root-02"
# set ca "-----BEGIN CERTIFICATE-----
#xxxxxxx
#-----END CERTIFICATE-----"
# set range global
# set source bundle
# set ssl-inspection-trusted enable
# set scep-url ''
# set source-ip 0.0.0.0
# set ca-identifier ''
# set obsolete disable
# next
#end

The same for all other certificates. Looks like all certificates are there and the settings are all identical.

Does anyone have any ideas?

Thank you very much!

[AnthonyH]

Hello Carsten,

You could try to recalculate the checksum on primary and secondary. If that does not work, would you be able to reboot the units?

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Procedure-for-HA-manual-synchronization/ta...

[fg_muc]

Just experienced this issue while upgrading from 7.0.15 to 7.2.9.
Recalculation of checksums and manual HA syncs didn't help.

A reboot of both cluster-members finally fixed it.

[Carsten]

Hello,
an update from 7.2.8 to 7.2.9 has not changed anything. Failover during the update process went without problems. Since only one certificate was not synchronized, I ignored the problem. And all other changes in the configuration were synchronized immediately.

An update from 7.2.9 to 7.2.10 solved the problem without any further action.
With best regards
Carsten