Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
zack
New Contributor

ha sync errors

getting this HA error: Message meets Alert condition date=2011-05-20 time=01:13:34 devname=Colo_FW_HA_2 device_id=FG300Axxxxxxxxxx log_id=0105037903 type=event subtype=ha pri=information vd=" root" msg=" The sync status with the master" sync_type=external-files sync_status=out-of-sync I have tried the command: execute ha synchronize all But that did not seem to fix it. Any other ideas? Fortinet said i need to dis-join the slave and rejoin it to the HA pair. these firewalls are in a co-location that is very far away so i would prefer not to have to travel to do this. thanks
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
26 REPLIES 26
rwpatterson
Valued Contributor III

It can be done remotely, as long as you put a valid routeable IP address on the connected port when you break the slave out. You remote into the slave via that interface, and join it back into the stack.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
zack

Don' t think I did that. When I joined it to the stack I just added it in right from an out of the box config. I also have the WAN connection as port 1 which I believe is the default LAN connection in an out of the box config. So I would lose connectivity it sounds like if i did this remotely. I do have a server there that has a console cable connection to each firewall in the stack. So I' m not completely without access. I was actually hopeful there was another way via the CLI to force these damn things to sync whatever is different.
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
rwpatterson
Valued Contributor III

When you disjoin a unit, you are asked to supply an IP address and an Interface to put it on. After it' s been removed, all interface settings (except the one) and routes are removed, but the rest of the config stays in place. So this being the only interface with an IP, you can get to it. I' ve done it several times.
Don' t think I did that. When I joined it to the stack I just added it in right from an out of the box config.
NOTE: Were they running the same version of code when you linked them together?

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
zack

yea they were. i was running firmware 3.2.6 for a few years with no issues. I upgraded to 4.2.6 following an upgrade path based on release notes. I have had this occurring ever since.
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
rwpatterson
Valued Contributor III

If you have the time, I would break them, do a flash format, install and resync with each. Should be no down time involved.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
zack

i think I' ll just drop the second one and re-add it. last time I tried a format on my 310B units it didn' t turn out well. the units wouldn' t boot in safe mode and find the tftp server to flash from. Fortinet thought I had a bad firewall and sent me a new one. the new one did the same thing! tftp server worked fine and was accessible from multiple other clients i tested from... EDIT: To clarify when I say the firewall wouldn’t boot in safe mode and pull down firmware from a tftp server…. The firewall never initialized its Ethernet port. The light on the port never came on and the laptop I had it connected to never had its port light up either. The laptop never reported an active network connection. I know you’re supposed to use a crossover cable, but al also tried a straight through cable, and even tried a switch and a hub in the middle. I following the documentation which direct which port to plug in and the IP scheme to use…. No luck. Fortinet through I had a bad firewall and sent me a replacement, but the replacement did the exact same thing… clearly a design flaw.
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
bmann
New Contributor

I have same error. At MR2 patch2. Running for few months, no changes and this error appears cca one a day. I thought that it is soem error after update before the files are synced.
billp
Contributor

I' m also getting this on my HA pair with 4.2.5. Just started with the upgrade to 4.2.x. Happens once a day around lunch time.

Bill ========== Fortigate 600C 5.0.12, 111C 5.0.2 Logstash 1.4.1

Bill ========== Fortigate 600C 5.0.12, 111C 5.0.2 Logstash 1.4.1
zack
New Contributor

What is really strange in your case billp is you' re running an active-active cluster. If something was actually out of sync you would be seeing some issues I would expect as i would think that the firewalls could be handling traffic differently. has anyone found a solution other then blowing up the cluster and recreating it?
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
Top Kudoed Authors