No WAN on HA after firmware Update

[Surcouf]

Hi everyone,

I recently performed a firmware upgrade on my HA (two firewalls).

After the reboot, I have no longer WAN access on my network when I plug the distribution port into my secondary firewall. There is still LAN though.

- The firewalls are seen as synchronized by the HA.
- I have replaced the SFP module which appears to be functioning correctly.
- The WAN outage only occurs when I plug in the secondary firewall distribution port (primary being plugged in OK).

I have already attempted a restart of the problematic firewall.

At this point, I don't have many ideas before restoring the backup and hoping that will solve the problem.

Thanks you very much for your time.

Jérémy.

[funkylicious]

Can you provide more details ?

What model, what was the firmware before / after , how does the problem actually manifest, what tests/checks have you performed , is the WAN ip public static ?

[Surcouf]

Hi Funkylicious,

Thanks for your reply.

Firewalls: 100F

Initial Firmware: FortiOS 7.2.3 Build1262

New Firmware: FortiOS 7.2.4 Build 1396

WAN IP: static

HA: The two Firewalls are synchronized

Ports on both firewalls:

WAN1 to Router 1

WAN2 to Router 2

HA1 to HA1 (Fw1 to Fw2)

HA2 to HA2 (Fw1 to Fw2)

Distribution Port# to internal switch

There was no physical intervention.

Since the update, there is no more WAN access from the network (Only LAN still works) when the Distribution Port from Secondary Firewall is pluggued. Alone or with the primary Firewall.

[Kojo1]

hi there Surcouf

Please I am currently facing this same or similar issue and pretty much followed the same steps as you have or did but still not getting any communication on the WAN but LAN is ok. device - 501E

WAN is static. port is x1(10gb) 

Initial Firmware: FortiOS 6.2.4 build --1112

New Firmware: FortiOS 7.4.1 Build 2463

followed the updates just as FortiOS recommended 

Were you able to resolve yours and how did you resolve it pls ? 

[Toshi_Esumi]

When I checked an upgrade path it showed totally 9 steps. Did you follow one of recommended paths? Then do you know what step caused the no internet? And, did you check "diag debug config-error-log read" in CLI on both HA units when that step was completed? It's recommended for every step so that to make sure this kind of problem didn't happen.

If no internet, likely something in the config got thrown out like interface config, policies, etc. if not dhcp/pppoe default route issue. And, it should be in the config error log.

If you didn't check at that time, I would recommend you go back to the version before that point then recover the saved config. Then, try it again then check.

Toshi

[Kojo1]

i downgraded to the very initial version (which got me to have with LAN communication but was not able to do that with the newer version - which i forgot to mention in my previous comment) but still had the issue with the WAN and i didnt do any "diag debug config-error-log read"

I will go ahead and check "diag debug config-error-log read".

thank you Toshi_Esumi

[Toshi_Esumi]

If you went back to 6.2.4 and restored the saved config and still the symptom persist (or didn't go back to previous normal operation), the problem is not caused by the config/upgrade but something happened to the circuit or the connection to the circuit when they were rebooted after the upgrade/downgrade.
You need to do basic troubleshooting against it, like ping, traceroute, snffing, flowdebugging, etc.

Toshi