Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
robinct
New Contributor

HA switch over changed policy using internet service

Just had an interesting experience when updating an HA a-p setup.

 

The failover unit was re-installed earlier this year due another issue. When updating firmware, it turns out the passive unit had an older version of the Internet Service Database Definitions. Given this, the unit simply replaced the services involved in the policy as some of the services didn't exist in the current version.

 

The policy had Microsoft-Office365, Microsoft-Microsoft.Update and Microsoft-Azure defined. After the failover switch, the policy was replaced with Microsoft-Office365, Microsoft-Other and Microsoft-Other.

 

How can I make sure this doesn't happen future wise? 

1 Solution
localhost

You can compare ISDB versions with:

 

#diag autoupdate versions

 

 

View solution in original post

4 REPLIES 4
localhost
Contributor III

Was the cluster configuration in sync before you started the upgrade?

 

We ran into similar problems, were ISDB entries just got deleted, when doing a multi-step firmware upgrade. This happens when the ISDB is out-of-date or empty.

Not sure if they fixed this in later firmware versions.

 

What I do is:

- Run Firmware Upgrade

- check if ISDB entries are populated again

- If not: execute a fortiguard refresh (System->Fortiguard, Update AV&IPS Definition)

- run #diagnose debug config-error-log read

- do next firmware upgrade

robinct

Yes, the configuration was in sync before the upgrade.

 

The config-error-log shows no errors. I still have a second upgrade to do, so will check versions between the two different units. If I understand correctly, the normal procedure would be that the two units share the same versions?

 

If not, how can I verify which versions are loaded on the passive unit?

localhost

You can compare ISDB versions with:

 

#diag autoupdate versions

 

 

robinct

Thanks.

 

Managed to verify that both of them are using the same versions at the moment. Will see how it looks when I run the next update.

Labels
Top Kudoed Authors