ha sync errors

[zack]

getting this HA error: Message meets Alert condition date=2011-05-20 time=01:13:34 devname=Colo_FW_HA_2 device_id=FG300Axxxxxxxxxx log_id=0105037903 type=event subtype=ha pri=information vd=" root" msg=" The sync status with the master" sync_type=external-files sync_status=out-of-sync I have tried the command: execute ha synchronize all But that did not seem to fix it. Any other ideas? Fortinet said i need to dis-join the slave and rejoin it to the HA pair. these firewalls are in a co-location that is very far away so i would prefer not to have to travel to do this. thanks

[zack]

I was instructed by Fortinet to use port 1. So that was the port i tried it on.

[romanr]

Hi,

For both NP1 and NP2 network processors, ports attached to a network processor cannot be used for firmware installation by TFTP.

You can find the description here: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=fromTD-FortinetAccelTech01-30005-0424-20070422pdf&sliceId=&docTypeID=DT_PRODUCTDOCUMENTATION_1_1&dialogID=26066697&stateId=0%200%2026068632 best regards, Roman

[zack]

This is very interesting because it contradicts the tftp firmware instructions in the previous KB article I referenced and instructions I received directly from Fortinet. However it does explain the trouble I had in completing the flash. Although the trouble I had with my 310b ended up being a firmware bug (which Fortinet tech support didn' t figure out until after they sent me a new firewall that exhibited the same behavior) Long story short I didn' t end up having to flash that firewall from a tftp server. But this does explain the failure and my trouble. Its kind of sad though that folks on these forums know more about the product than the support department for the manufacturer. Now as for this issue with the HA sync errors - This would be on 2 Fortigate 300A firewalls in a cluster. The link you sent doesn' t reference this specific model. Should I then presume there is no network acceleration processor and I could flash from port 1?

[ede_pfau]

You can list which ports are on which NPU (network processing unit - a specific ASIC for fast processing of session data) via this CLI command:

fw01 # diagnose npu np2 list 
 ID       PORTS
 --       -----
 0        port6
 0        port5
 0        port8
 0        port7
 ID       PORTS
 --       -----
 1        port2
 1        port1
 1        port4
 1        port3
 

This is from a FGT-310B which has two NP2s built-in. Newer FGTs like the 1240, 3040, 3140, 3950 use the next generation NP4. You would use the

fw01 # diagnose npu NP4 list 

command for these. For a 310B you can clearly see that for a TFTP download you' d use port 9. edit: if the diag command returns with an error then there are no NPs built in.

[zack]

On a 310B it looks like port 9 or port 10 would work. I guess you would use the lowest numbered port in that case. On my 300A models diagnose npu isn' t a valid command. so i' m guessing there is no network processing unit in those models. So I would imagine port 1 in that case. thanks for the info.

[TopJimmy]

ORIGINAL: ede_pfau You can list which ports are on which NPU (network processing unit - a specific ASIC for fast processing of session data) via this CLI command:

fw01 # diagnose npu np2 list 
 ID       PORTS
 --       -----
 0        port6
 0        port5
 0        port8
 0        port7
 ID       PORTS
 --       -----
 1        port2
 1        port1
 1        port4
 1        port3
 

This is from a FGT-310B which has two NP2s built-in. Newer FGTs like the 1240, 3040, 3140, 3950 use the next generation NP4. You would use the

fw01 # diagnose npu NP4 list 

command for these. For a 310B you can clearly see that for a TFTP download you' d use port 9. edit: if the diag command returns with an error then there are no NPs built in.

Interesting. My 620b' s have the following output but if memory serves me, I' ve loaded the firmware via TFTP numerous times on port1. I guess I' ll just have to try again and report back. ID PORTS -- ----- 0 port1 0 port2 0 port3 0 port4 ID PORTS -- ----- 1 port5 1 port6 1 port7 1 port8 ID PORTS -- ----- 2 port9 2 port10 2 port11 2 port12 ID PORTS -- ----- 3 port13 3 port14 3 port15 3 port16

[zack]

I was told by Fortinet to use port 1. I followed their instructions to the letter. When you say " non Np2 port" that exactly do you mean by NP2 port? I suspect it is possible I could have been using the wrong port, but you would think Fortinet tech support would know which port I should be using... I was referred to: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=10338&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=11183031&stateId=0%200%2011181817 Which also has a chart that says which port to use.