Hello - I have a customer who updated to version 7.2.3 to be clear of the recent SSLVPN vulnerability; however, HA is out of sync and comparing out puts it is showing the vpn.certficiate.ca.
This shows to be a bug in an earlier version.
Any advice?
Thank you
Have you tried recalculating the checksums of both HA nodes? That sometimes helps.
One of the first things I did on both units and no joy.
Hi Team,
I understood the issue.
Can you please let me know if its in vdom environment. If its vdom environment in which vdom the HA sync not happening. Is it like in some vdom the certificate present and in some other certificate not present?
If its not in vdom environment, please execute this commnad in both firewalls:
#config vpn certificate ca
#show full
Compare both texts and let us know which certificate is mismatching
If you get to know which certificate is having the issue, please execute these commands and share us the output:
config vpn certificate ca
edit <cert-name>
show full
end
Please execute commands in both firewalls and share us the output
Actually, it seems much simpler - the backup did not take the upgrade for some reason. So right now HA2 is at 7.2.3 and HA1 is at 7.2.2
The client will update HA1 after hours. Not really sure why it did not take since it is setup as HA.
7.2.3 is really new, maybe a hiccup in the code??
had the same happen to me on a 101F cluster - 7.0.14
For reference:
I got mismatches on system.central-management and certificate.ca - checking those showed absolutely identical. Then I ended up on this post - I ended up logging on to the fgt with lower version and upgraded from there manually again.
@bigkeoni64 wrote:Hello - I have a customer who updated to version 7.2.3 to be clear of the recent SSLVPN vulnerability; however, HA is out of sync and comparing out puts crayon it is showing the vpn.certficiate.ca.
This shows to be a bug in an earlier version.
Any advice?
Thank you
HI bigkeoni
I Think This issue may occur from a bug present in earlier versions. Please check the release notes and documentation for version 7.2.3 to identify any known issues related to HA synchronization or the vpn.certficiate.ca discrepancy. Additionally, a thorough review of the HA configuration settings on both devices is advised to ensure they are correctly configured and matching.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.