Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
bigkeoni64
Contributor

HA out of sync due to vpn.certficiate.ca

Hello - I have a customer who updated to version 7.2.3 to be clear of the recent SSLVPN vulnerability; however, HA is out of sync and comparing out puts it is showing the vpn.certficiate.ca.

bigkeoni64_0-1671214294803.png

 

This shows to be a bug in an earlier version.

 

Any advice?

 

Thank you

8 REPLIES 8
FredPaul
New Contributor III

Have you tried recalculating the checksums of both HA nodes? That sometimes helps.

-Fredrik
-Fredrik
bigkeoni64

One of the first things I did on both units and no joy.

seshuganesh
Staff
Staff

Hi Team,

 

I understood the issue.

Can you please let me know if its in vdom environment. If its vdom environment in which vdom the HA sync not happening. Is it like in some vdom the certificate present and in some other certificate not present?
If its not in vdom environment, please execute this commnad in both firewalls:

#config vpn certificate ca

#show full

Compare both texts and let us know which certificate is mismatching

If you get to know which certificate is having the issue, please execute these commands and share us the output:

config vpn certificate ca

edit <cert-name>

show full

end

 

Please execute commands in both firewalls and share us the output

 

bigkeoni64

Actually, it seems much simpler - the backup did not take the upgrade for some reason. So right now HA2 is at 7.2.3 and HA1 is at 7.2.2

 

The client will update HA1 after hours. Not really sure why it did not take since it is setup as HA.

 

7.2.3 is really new, maybe a hiccup in the code??

LKA
New Contributor

had the same happen to me on a 101F cluster - 7.0.14

 

For reference:

I got mismatches on system.central-management and certificate.ca - checking those showed absolutely identical. Then I ended up on this post - I ended up logging on to the fgt with lower version and upgraded from there manually again.

lastreaction122
New Contributor II


@bigkeoni64 wrote:

Hello - I have a customer who updated to version 7.2.3 to be clear of the recent SSLVPN vulnerability; however, HA is out of sync and comparing out puts crayon it is showing the vpn.certficiate.ca.

bigkeoni64_0-1671214294803.png

 

This shows to be a bug in an earlier version.

 

Any advice?

 

Thank you


HI bigkeoni

I Think This issue may occur from a bug present in earlier versions. Please check the release notes and documentation for version 7.2.3 to identify any known issues related to HA synchronization or the vpn.certficiate.ca discrepancy. Additionally, a thorough review of the HA configuration settings on both devices is advised to ensure they are correctly configured and matching.

Carsten
New Contributor

Hello,
I have the same problem here. Yesterday I updated from 7.0.14 to 7.2.8 on my active-passive cluster. An error was displayed during the update, but both firewalls were on version 7.2.8.
Now the cluster is no longer synchronized. The checksum of vpn.certificate.ca is different.

 

active Firewall:
#config vpn certificate ca
#show full
shows long list with all certificates

 

passive firewall:
#config vpn certificate ca
#show full

output:
#config vpn certificate ca
#end

 

but:

#edit "CommScope_Public_Trust_RSA_Root-02"
#show full
#config vpn certificate ca
# edit "CommScope_Public_Trust_RSA_Root-02"
# set ca "-----BEGIN CERTIFICATE-----
#xxxxxxx
#-----END CERTIFICATE-----"
# set range global
# set source bundle
# set ssl-inspection-trusted enable
# set scep-url ''
# set source-ip 0.0.0.0
# set ca-identifier ''
# set obsolete disable
# next
#end

 

The same for all other certificates. Looks like all certificates are there and the settings are all identical.

 

Does anyone have any ideas?

 

Thank you very much!

AnthonyH
Staff
Staff

Hello Carsten,

 

You could try to recalculate the checksum on primary and secondary. If that does not work, would you be able to reboot the units?

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Procedure-for-HA-manual-synchronization/ta...

Technical Support Engineer,
Anthony.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors