Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
jomof
New Contributor III

Secondary cluster member not synchronizing with the Primary

Hello Expert,

 

We have two 400E fortigates in a HA cluster.
This afternoon we temporary shutdown the secondary member in facilitate changing a defective patch cable which was connected to the respective HA ports on the active and passive device.
The defective cable was remove ad replace with new one.
When the secondary FortiGate was repowered during checking the system status it was discovered HA was out of sync.
I humbly request you assistance to fix same.

1 Solution
ozkanaltas
Valued Contributor III

Hello @jomof,

 

This change you make should not affect traffic.

 

The reason why Fortigates cannot synchronize is because the priority is in an unacceptable range. In old versions, you could set the priority value to 0, but in new versions you need to set it to minimum 1. This value did not change during the upgrade, even though it should have. This was corrected in the configuration check when the secondary device was turned on. If you change this value to 1 on the first device, the synchronization problem will be solved. Also, if you want to confirm this, you can run these commands on the secondary device and check the priority value.

 

config router static

edit 1

show full-configuration

end

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW

View solution in original post

If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
10 REPLIES 10
ozkanaltas
Valued Contributor III

Hello @jomof ,

 

You can review this document about troubleshooting the HA sync problem. 

 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-troubleshoot-HA-synchronizati...

 

You can see which part is not synchronized on the GUI.

 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-HA-out-of-synchronization/ta-p/27350...

 

And also, did you try to any changes to the primary unit? (Like a create address object) Configuration change triggers the HA sync process.

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
jomof
New Contributor III

Hello Expert,

 

>> And also, did you try to any changes to the primary unit? (Like a create address object) Configuration change triggers the HA sync process. no

should i try a change to force a sync.

Thanks

 

Regards

ozkanaltas
Valued Contributor III

Hello @jomof ,

 

You can try, this is not a dangerous thing. 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
jomof
New Contributor III

Hello Expert,

After reviewing the document I found the mismatch 

 

1 Table Out of Sync - Guy-Office-1 (Primary) vs. Guy-Office-2 (Secondary)

Table Guy-Office-1 (Primary) Guy-Office-2 (Secondary)

router.Static235bab5c7c14d9d2884ce48b3b804f1220f7b91b603d222960e1d2dd9037a158

 

 

Guy-Office-1 # show route static
config router static
edit 1
set gateway 10.1pp.ccc.1
set distance 250
set priority 0                                        
set device "port8"


Guy-Office-2 # show route static
config router static
edit 1
set gateway 10.1pp.ccc.1
set distance 250
set device "port8"
next

 

My problem is when I try to inserting  the line on the secondary config I am getting an error message

 

Guy-Office-1 # execute ha manage 1 dann04152

Guy-Office-2 # config route static

Guy-Office-2 (static) # edit 1

Guy-Office-2 (1) # set priority 0
The priority value 0 must be in the range of 1-65535.

value parse error before '0'
Command fail. Return code -61

Guy-Office-2 (1) #


end

 

Could you provide some guidance .

Thanks 

Toshi_Esumi

Generally that kind of situation would be resolved by rebooting the secondary unit. In our cases most of out-of-sync problems happen to IPsec phase1-interface config because we have hundreds of them and more importantly we keep changing/moving them around. We, like your case, can't correct on the secondary to match the primary. Then when we reboot the secondary, it's able to correct the problem by itself while re-syncing after the reboot.

Toshi

ozkanaltas
Valued Contributor III

Hello @jomof ,

 

Can you change the priority on the master device to 1?

 

config router static
edit 1
set priority 1
end

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
jomof
New Contributor III

Can you change the priority on the master device to 1? think so

It is production environment a bit hesitant.

  

ozkanaltas
Valued Contributor III

Hello @jomof,

 

This change you make should not affect traffic.

 

The reason why Fortigates cannot synchronize is because the priority is in an unacceptable range. In old versions, you could set the priority value to 0, but in new versions you need to set it to minimum 1. This value did not change during the upgrade, even though it should have. This was corrected in the configuration check when the secondary device was turned on. If you change this value to 1 on the first device, the synchronization problem will be solved. Also, if you want to confirm this, you can run these commands on the secondary device and check the priority value.

 

config router static

edit 1

show full-configuration

end

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
jomof
New Contributor III

Hello 

 

You are correct i will effect the change this afternoon and will update the post accordingly.

 

Guy-Office-1 (1) # show full-configuration
config router static
edit 1
set status enable
set dst 0.0.0.0 0.0.0.0
set gateway 10.1pp.ccc.1
set distance 250
set weight 0
set priority 0
set device "port8"
set comment ''
set blackhole disable
set dynamic-gateway disable
set dstaddr ''
unset internet-service
set internet-service-custom ''
set link-monitor-exempt disable
set bfd disable
next
end

Guy-Head-Office-1 (1) # execute ha manage 1 dann04152

 

Guy-Head-Office-2 # config router static

Guy-Head-Office-2 (static) # edit 1

Guy-Head-Office-2 (1) # sh full-configuration
config router static
edit 1
set status enable
set dst 0.0.0.0 0.0.0.0
set gateway 10.1pp.ccc.1
set distance 250
set weight 0
set priority 1
set device "port8"
set comment ''
set blackhole disable
set dynamic-gateway disable
set dstaddr ''
unset internet-service
set internet-service-custom ''
set link-monitor-exempt disable
set bfd disable
next
end

 

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors