Secondary cluster member not synchronizing with the Primary

[jomof]

Hello Expert,

We have two 400E fortigates in a HA cluster.
This afternoon we temporary shutdown the secondary member in facilitate changing a defective patch cable which was connected to the respective HA ports on the active and passive device.
The defective cable was remove ad replace with new one.
When the secondary FortiGate was repowered during checking the system status it was discovered HA was out of sync.
I humbly request you assistance to fix same.

[ozkanaltas]

Hello @jomof ,

You can review this document about troubleshooting the HA sync problem. 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-troubleshoot-HA-synchronizati...

You can see which part is not synchronized on the GUI.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-HA-out-of-synchronization/ta-p/27350...

And also, did you try to any changes to the primary unit? (Like a create address object) Configuration change triggers the HA sync process.

[jomof]

Hello Expert,

>> And also, did you try to any changes to the primary unit? (Like a create address object) Configuration change triggers the HA sync process. no

should i try a change to force a sync.

Thanks

Regards

[ozkanaltas]

Hello @jomof ,

You can try, this is not a dangerous thing. 

[jomof]

Hello Expert,

After reviewing the document I found the mismatch 

1 Table Out of Sync - Guy-Office-1 (Primary) vs. Guy-Office-2 (Secondary)

Table Guy-Office-1 (Primary) Guy-Office-2 (Secondary)

router.Static

235bab5c7c14d9d2884ce48b3b804f12

20f7b91b603d222960e1d2dd9037a158

Guy-Office-1 # show route static
config router static
edit 1
set gateway 10.1pp.ccc.1
set distance 250
set priority 0                                        
set device "port8"

Guy-Office-2 # show route static
config router static
edit 1
set gateway 10.1pp.ccc.1
set distance 250
set device "port8"
next

My problem is when I try to inserting  the line on the secondary config I am getting an error message

Guy-Office-1 # execute ha manage 1 dann04152

Guy-Office-2 # config route static

Guy-Office-2 (static) # edit 1

Guy-Office-2 (1) # set priority 0
The priority value 0 must be in the range of 1-65535.

value parse error before '0'
Command fail. Return code -61

Guy-Office-2 (1) #

end

Could you provide some guidance .

Thanks 

[Toshi_Esumi]

Generally that kind of situation would be resolved by rebooting the secondary unit. In our cases most of out-of-sync problems happen to IPsec phase1-interface config because we have hundreds of them and more importantly we keep changing/moving them around. We, like your case, can't correct on the secondary to match the primary. Then when we reboot the secondary, it's able to correct the problem by itself while re-syncing after the reboot.

Toshi

[ozkanaltas]

Hello @jomof ,

Can you change the priority on the master device to 1?

config router static
edit 1
set priority 1
end

[jomof]

Can you change the priority on the master device to 1? think so

It is production environment a bit hesitant.

[ozkanaltas · Accepted solution]

Hello @jomof,

This change you make should not affect traffic.

The reason why Fortigates cannot synchronize is because the priority is in an unacceptable range. In old versions, you could set the priority value to 0, but in new versions you need to set it to minimum 1. This value did not change during the upgrade, even though it should have. This was corrected in the configuration check when the secondary device was turned on. If you change this value to 1 on the first device, the synchronization problem will be solved. Also, if you want to confirm this, you can run these commands on the secondary device and check the priority value.

config router static

edit 1

show full-configuration

end

[jomof]

Hello 

You are correct i will effect the change this afternoon and will update the post accordingly.

Guy-Office-1 (1) # show full-configuration
config router static
edit 1
set status enable
set dst 0.0.0.0 0.0.0.0
set gateway 10.1pp.ccc.1
set distance 250
set weight 0
set priority 0
set device "port8"
set comment ''
set blackhole disable
set dynamic-gateway disable
set dstaddr ''
unset internet-service
set internet-service-custom ''
set link-monitor-exempt disable
set bfd disable
next
end

Guy-Head-Office-1 (1) # execute ha manage 1 dann04152

Guy-Head-Office-2 # config router static

Guy-Head-Office-2 (static) # edit 1

Guy-Head-Office-2 (1) # sh full-configuration
config router static
edit 1
set status enable
set dst 0.0.0.0 0.0.0.0
set gateway 10.1pp.ccc.1
set distance 250
set weight 0
set priority 1
set device "port8"
set comment ''
set blackhole disable
set dynamic-gateway disable
set dstaddr ''
unset internet-service
set internet-service-custom ''
set link-monitor-exempt disable
set bfd disable
next
end