Reactivate HA cluster.

[itg1]

Hello, I have a Fortigate 500E scenario and cluster, active/passive. The passive equipment cannot synchronize the data with the active equipment, it has been several days. Fortinet recommended removing all the cables, formatting the equipment, leaving it at the same firmware version as the active equipment in production, uploading a backup of the configurations, connecting only the HA cable, waiting for synchronization and reconnecting the other cables. But I ask, instead of formatting, wouldn't it be enough just to run the command exec factoryreset and exec formatlogdisk?

Detail, right after restoring the cluster, I will update the firmware, as both devices are still in version 6.2.4.

Thanks for everyone's contribution.

[Toshi_Esumi]

Resting the config to the factory doesn't add anything since you're going to upload the config file anyway. If config was the issue that would be enough to recover.

But since you're upload the config file, it's a good measure to re-format the boot drive to correct any possible corruption in the file system, and load the image. Or TAC might have seen some sign of corruption when troubleshooting it. But unlikely.

Toshi

[itg1]

I don't believe in FortiOS corruption. But one thing I noticed is that the devices have a different firmware version. FGT Primary - Version: FortiGate-500E v6.2.14,build1364,230411 (GA).

Secondary FGT - Version: FortiGate-500E 6.2.15,build1378,230605 (GA) So, leave both in the same version 6.2.14, synchronized and then apply the firmware.

Another thing I thought of was: Reset the secondary FGT, upload the backup of the settings obtained from the primary FGT, update the firmware to the latest version, put all the cables back and put it in production, validating that everything is working, keep the HA cable disconnected, then update the primary FGT firmware, ensure that the settings are the same, connect the HA cable and reactivate the cluster.

[Toshi_Esumi]

I assumed the HA was working before then stopped working. If the version was different, it would never form HA. If you're trying to set up HA first time, first you need to make the version the same. Then any upgrade, I would recommend doing it after HA is formed. It's easier because when you trigger it it automatically upgrade both, secondary first, swap, then previous primary.

When you upload the primary config to the new secondary, you want to modify the host name, management interface IPs and override config in ha if used before uploading. Those are exempt from syncing.

Toshi

[itg1]

The HA used to work, but another professional went to update the firmware, he had a problem in the process, so the equipment had different versions and stopped synchronizing.

So I was called to solve this problem. I will follow this script: execute factory reset exec formatlogdisk Leave the equipment with the same firmware version as the primary one, which is in production, upload the configuration backup, changing hostname, management IP and HA priority and connect the cluster cable.

Connect the other cables after synchronizing.

Anyway, apply the missing firmwares, until you reach the last version.

[ede_pfau]

Hopefully, it's not too late.

I've experienced your situation several times lately, namely that the upgrade 'hangs' on upgrading the previous primary unit.

The solution is the following:

1- fail over the cluster to make the not-yet-upgraded FGT the primary

2- initiate the upgrade

3- during upload of the firmware image, like at 40...60%, reboot the secondary

4- primary will now happily upgrade and cluster will be formed after the respective reboots

Source: TAC