Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
zack
New Contributor

ha sync errors

getting this HA error: Message meets Alert condition date=2011-05-20 time=01:13:34 devname=Colo_FW_HA_2 device_id=FG300Axxxxxxxxxx log_id=0105037903 type=event subtype=ha pri=information vd=" root" msg=" The sync status with the master" sync_type=external-files sync_status=out-of-sync I have tried the command: execute ha synchronize all But that did not seem to fix it. Any other ideas? Fortinet said i need to dis-join the slave and rejoin it to the HA pair. these firewalls are in a co-location that is very far away so i would prefer not to have to travel to do this. thanks
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
26 REPLIES 26
billp
Contributor

Message meets Alert condition date=2011-05-20 time=12:29:05 devname=FG10CHxxxxxxx device_id=FG10CHxxxxxxx log_id=0105037903 type=event subtype=ha pri=information vd=" root" msg=" The sync status with the master" sync_type=external-files sync_status=out-of-sync FWIW, my error message above. It arrives at almost the same time every day, although interestingly it didn' t arrive today. I' m in a " freeze" zone now for maintenance, so won' t make any changes until first week of June, at which point I' ll replace the cluster with a single Fortigate 200B. As far as I can tell, firewall service has not been impacted by this error message. -- My problem could be that I' m using 4.2.5 instead of 4.2.6, but since Zack also has the problem with 4.2.6, that doesn' t seem likely.

Bill ========== Fortigate 600C 5.0.12, 111C 5.0.2 Logstash 1.4.1

Bill ========== Fortigate 600C 5.0.12, 111C 5.0.2 Logstash 1.4.1
rwpatterson
Valued Contributor III

Is an update coming down at that time?

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
zack
New Contributor

okay you want to know something funny. When billp reported that he didn' t get the once daily error message, i didn;t get it either... figure that one out... Mine usually come in overnight. i actually haven;t gotten once since 5/21
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
billp
Contributor

Bob, Not sure. I have the Fortiguard update set for every 4 hours. So, it' s possible it' s updating, but that would not be the only time it would update.

Bill ========== Fortigate 600C 5.0.12, 111C 5.0.2 Logstash 1.4.1

Bill ========== Fortigate 600C 5.0.12, 111C 5.0.2 Logstash 1.4.1
connect555
New Contributor

A very interesting thread... We have also a 110C A-A Cluster which have the same error. It happens 0 to 3 times per day, mostly at night, when there are <100 Sessions active. Has anyone tried to switch master and slave? (higher/lower priority) Last time we tried this, we got a new error: The cluster reboots itself, every time the error appears. :(
TopJimmy
New Contributor

I' ve gotten this since upgrading to 4.2.x (not sure which build but at least the last 4) and I' ve narrowed it down to the AV/IPS update schedule. As a test, try changing your schedule to a different time and see if you get that notification at that new time. Mine did on every unit that exhibited the problem.
-TJ
-TJ
zack
New Contributor

I had suspected AV/IPS definition updates were causing the error. Mine are set to update hourly though and i really don' t want to change to a more infrequent update schedule. As an FYI I did what Fortinet recommended by breaking and recreating the firewall cluster. No change or improvement as i still get the error daily. I got it after upgrading to 4.2.6 and still get it with 4.2.9. Kind of annoying. Since I had suspected this was an error generated by av/ips updates AND those updates always appear to be in sync when I check - i have taken to ignoring he error. I wish they would fix it though... Based on the amount of equipment in your signature TopJimmy I place weight on your thoughts as confirming my opinion. Thanks for the info.
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
TopJimmy
New Contributor

ORIGINAL: zack I had suspected AV/IPS definition updates were causing the error. Mine are set to update hourly though and i really don' t want to change to a more infrequent update schedule. As an FYI I did what Fortinet recommended by breaking and recreating the firewall cluster. No change or improvement as i still get the error daily. I got it after upgrading to 4.2.6 and still get it with 4.2.9. Kind of annoying. Since I had suspected this was an error generated by av/ips updates AND those updates always appear to be in sync when I check - i have taken to ignoring he error. I wish they would fix it though... Based on the amount of equipment in your signature TopJimmy I place weight on your thoughts as confirming my opinion. Thanks for the info.
What' s worked for me was essentially what Bob posted above. Break the HA cluster, disconnect the slave completely. Wipe it and reload the same version firmware that the master has using the TFTP process (never had one of those fail but I don' t have any 320' s). When that is done, I boot it into the OS, and plug an ethernet cable from my PC (laptop) into the internal interface (depends on unit), make sure HTTPS for web management is on via the console and then I upload the current config from the master (after editing the system name and HA priority). Then reboot it again (watching from console cable) and check to see if it comes back up without any errors. If it looks good, I power it down, re-cable it back into the cluster (mine is full mesh) and power it back on. It will join the cluster and sync. This process works for me every time. I' ve only had to do a few times in 5 years due to the sync process failing and not correcting itself but I' ve had to do a few other times for adding new slaves into the cluster or replacing bad hardware. I' ve got it down where the whole process, if I have my ducks in a row, is done in less than 15 minutes. This assumes you have physical access to the cluster. I' ve had to travel to do this once or twice but I do it because I want to assure it' s done right.
-TJ
-TJ
zack
New Contributor

I have sadly had the loading of firmware fail from a TFTP server. My 310B won' t power up the Ethernet port during the process and thus never finds the TFTP server. I tried cross over cables, straight cables, going through a switch, etc. You name it - no love. I had worked on this with Fortinet as well and they sent me a replacement firewall - which did the same thing. So I put the replacement back in the box and sent it back. i have another ticket open with Fortinet now. Although its now been a week and they have no fixes or suggestions. I think i have them stumped...
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
Maik
New Contributor II

only read your latest post zack. on what port did you do the tftp process? it only works with a non NP2 interface, so on a 310b your result should be better with port9 oder 10...
Top Kudoed Authors