HA switch over changed policy using internet service

[robinct]

Just had an interesting experience when updating an HA a-p setup.

The failover unit was re-installed earlier this year due another issue. When updating firmware, it turns out the passive unit had an older version of the Internet Service Database Definitions. Given this, the unit simply replaced the services involved in the policy as some of the services didn't exist in the current version.

The policy had Microsoft-Office365, Microsoft-Microsoft.Update and Microsoft-Azure defined. After the failover switch, the policy was replaced with Microsoft-Office365, Microsoft-Other and Microsoft-Other.

How can I make sure this doesn't happen future wise? 

[localhost]

Was the cluster configuration in sync before you started the upgrade?

We ran into similar problems, were ISDB entries just got deleted, when doing a multi-step firmware upgrade. This happens when the ISDB is out-of-date or empty.

Not sure if they fixed this in later firmware versions.

What I do is:

- Run Firmware Upgrade

- check if ISDB entries are populated again

- If not: execute a fortiguard refresh (System->Fortiguard, Update AV&IPS Definition)

- run #diagnose debug config-error-log read

- do next firmware upgrade

[robinct]

Yes, the configuration was in sync before the upgrade.

The config-error-log shows no errors. I still have a second upgrade to do, so will check versions between the two different units. If I understand correctly, the normal procedure would be that the two units share the same versions?

If not, how can I verify which versions are loaded on the passive unit?

[localhost · Accepted solution]

You can compare ISDB versions with:

#diag autoupdate versions

[robinct]

Thanks.

Managed to verify that both of them are using the same versions at the moment. Will see how it looks when I run the next update.