ha sync errors

[zack]

getting this HA error: Message meets Alert condition date=2011-05-20 time=01:13:34 devname=Colo_FW_HA_2 device_id=FG300Axxxxxxxxxx log_id=0105037903 type=event subtype=ha pri=information vd=" root" msg=" The sync status with the master" sync_type=external-files sync_status=out-of-sync I have tried the command: execute ha synchronize all But that did not seem to fix it. Any other ideas? Fortinet said i need to dis-join the slave and rejoin it to the HA pair. these firewalls are in a co-location that is very far away so i would prefer not to have to travel to do this. thanks

[billp]

Message meets Alert condition date=2011-05-20 time=12:29:05 devname=FG10CHxxxxxxx device_id=FG10CHxxxxxxx log_id=0105037903 type=event subtype=ha pri=information vd=" root" msg=" The sync status with the master" sync_type=external-files sync_status=out-of-sync FWIW, my error message above. It arrives at almost the same time every day, although interestingly it didn' t arrive today. I' m in a " freeze" zone now for maintenance, so won' t make any changes until first week of June, at which point I' ll replace the cluster with a single Fortigate 200B. As far as I can tell, firewall service has not been impacted by this error message. -- My problem could be that I' m using 4.2.5 instead of 4.2.6, but since Zack also has the problem with 4.2.6, that doesn' t seem likely.

[rwpatterson]

Is an update coming down at that time?

[zack]

okay you want to know something funny. When billp reported that he didn' t get the once daily error message, i didn;t get it either... figure that one out... Mine usually come in overnight. i actually haven;t gotten once since 5/21

[billp]

Bob, Not sure. I have the Fortiguard update set for every 4 hours. So, it' s possible it' s updating, but that would not be the only time it would update.

[connect555]

A very interesting thread... We have also a 110C A-A Cluster which have the same error. It happens 0 to 3 times per day, mostly at night, when there are <100 Sessions active. Has anyone tried to switch master and slave? (higher/lower priority) Last time we tried this, we got a new error: The cluster reboots itself, every time the error appears. :(

[TopJimmy]

I' ve gotten this since upgrading to 4.2.x (not sure which build but at least the last 4) and I' ve narrowed it down to the AV/IPS update schedule. As a test, try changing your schedule to a different time and see if you get that notification at that new time. Mine did on every unit that exhibited the problem.

[zack]

I had suspected AV/IPS definition updates were causing the error. Mine are set to update hourly though and i really don' t want to change to a more infrequent update schedule. As an FYI I did what Fortinet recommended by breaking and recreating the firewall cluster. No change or improvement as i still get the error daily. I got it after upgrading to 4.2.6 and still get it with 4.2.9. Kind of annoying. Since I had suspected this was an error generated by av/ips updates AND those updates always appear to be in sync when I check - i have taken to ignoring he error. I wish they would fix it though... Based on the amount of equipment in your signature TopJimmy I place weight on your thoughts as confirming my opinion. Thanks for the info.

[TopJimmy]

ORIGINAL: zack I had suspected AV/IPS definition updates were causing the error. Mine are set to update hourly though and i really don' t want to change to a more infrequent update schedule. As an FYI I did what Fortinet recommended by breaking and recreating the firewall cluster. No change or improvement as i still get the error daily. I got it after upgrading to 4.2.6 and still get it with 4.2.9. Kind of annoying. Since I had suspected this was an error generated by av/ips updates AND those updates always appear to be in sync when I check - i have taken to ignoring he error. I wish they would fix it though... Based on the amount of equipment in your signature TopJimmy I place weight on your thoughts as confirming my opinion. Thanks for the info.

What' s worked for me was essentially what Bob posted above. Break the HA cluster, disconnect the slave completely. Wipe it and reload the same version firmware that the master has using the TFTP process (never had one of those fail but I don' t have any 320' s). When that is done, I boot it into the OS, and plug an ethernet cable from my PC (laptop) into the internal interface (depends on unit), make sure HTTPS for web management is on via the console and then I upload the current config from the master (after editing the system name and HA priority). Then reboot it again (watching from console cable) and check to see if it comes back up without any errors. If it looks good, I power it down, re-cable it back into the cluster (mine is full mesh) and power it back on. It will join the cluster and sync. This process works for me every time. I' ve only had to do a few times in 5 years due to the sync process failing and not correcting itself but I' ve had to do a few other times for adding new slaves into the cluster or replacing bad hardware. I' ve got it down where the whole process, if I have my ducks in a row, is done in less than 15 minutes. This assumes you have physical access to the cluster. I' ve had to travel to do this once or twice but I do it because I want to assure it' s done right.

[zack]

I have sadly had the loading of firmware fail from a TFTP server. My 310B won' t power up the Ethernet port during the process and thus never finds the TFTP server. I tried cross over cables, straight cables, going through a switch, etc. You name it - no love. I had worked on this with Fortinet as well and they sent me a replacement firewall - which did the same thing. So I put the replacement back in the box and sent it back. i have another ticket open with Fortinet now. Although its now been a week and they have no fixes or suggestions. I think i have them stumped...

[Maik]

only read your latest post zack. on what port did you do the tftp process? it only works with a non NP2 interface, so on a 310b your result should be better with port9 oder 10...