Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
zack
New Contributor

ha sync errors

getting this HA error: Message meets Alert condition date=2011-05-20 time=01:13:34 devname=Colo_FW_HA_2 device_id=FG300Axxxxxxxxxx log_id=0105037903 type=event subtype=ha pri=information vd=" root" msg=" The sync status with the master" sync_type=external-files sync_status=out-of-sync I have tried the command: execute ha synchronize all But that did not seem to fix it. Any other ideas? Fortinet said i need to dis-join the slave and rejoin it to the HA pair. these firewalls are in a co-location that is very far away so i would prefer not to have to travel to do this. thanks
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
26 REPLIES 26
zack
New Contributor

I was instructed by Fortinet to use port 1. So that was the port i tried it on.
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
romanr
Valued Contributor

Hi,
For both NP1 and NP2 network processors, ports attached to a network processor cannot be used for firmware installation by TFTP.
You can find the description here: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=fromTD-FortinetAccelTech01-30005-0424-20070422pdf&sliceId=&docTypeID=DT_PRODUCTDOCUMENTATION_1_1&dialogID=26066697&stateId=0%200%2026068632 best regards, Roman
zack
New Contributor

This is very interesting because it contradicts the tftp firmware instructions in the previous KB article I referenced and instructions I received directly from Fortinet. However it does explain the trouble I had in completing the flash. Although the trouble I had with my 310b ended up being a firmware bug (which Fortinet tech support didn' t figure out until after they sent me a new firewall that exhibited the same behavior) Long story short I didn' t end up having to flash that firewall from a tftp server. But this does explain the failure and my trouble. Its kind of sad though that folks on these forums know more about the product than the support department for the manufacturer. Now as for this issue with the HA sync errors - This would be on 2 Fortigate 300A firewalls in a cluster. The link you sent doesn' t reference this specific model. Should I then presume there is no network acceleration processor and I could flash from port 1?
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
ede_pfau
Esteemed Contributor III

You can list which ports are on which NPU (network processing unit - a specific ASIC for fast processing of session data) via this CLI command:
fw01 # diagnose npu np2 list 
 ID       PORTS
 --       -----
 0        port6
 0        port5
 0        port8
 0        port7
 ID       PORTS
 --       -----
 1        port2
 1        port1
 1        port4
 1        port3
 
This is from a FGT-310B which has two NP2s built-in. Newer FGTs like the 1240, 3040, 3140, 3950 use the next generation NP4. You would use the
fw01 # diagnose npu NP4 list 
command for these. For a 310B you can clearly see that for a TFTP download you' d use port 9. edit: if the diag command returns with an error then there are no NPs built in.

Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
zack
New Contributor

On a 310B it looks like port 9 or port 10 would work. I guess you would use the lowest numbered port in that case. On my 300A models diagnose npu isn' t a valid command. so i' m guessing there is no network processing unit in those models. So I would imagine port 1 in that case. thanks for the info.
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
TopJimmy

ORIGINAL: ede_pfau You can list which ports are on which NPU (network processing unit - a specific ASIC for fast processing of session data) via this CLI command:
fw01 # diagnose npu np2 list 
 ID       PORTS
 --       -----
 0        port6
 0        port5
 0        port8
 0        port7
 ID       PORTS
 --       -----
 1        port2
 1        port1
 1        port4
 1        port3
 
This is from a FGT-310B which has two NP2s built-in. Newer FGTs like the 1240, 3040, 3140, 3950 use the next generation NP4. You would use the
fw01 # diagnose npu NP4 list 
command for these. For a 310B you can clearly see that for a TFTP download you' d use port 9. edit: if the diag command returns with an error then there are no NPs built in.
Interesting. My 620b' s have the following output but if memory serves me, I' ve loaded the firmware via TFTP numerous times on port1. I guess I' ll just have to try again and report back. ID PORTS -- ----- 0 port1 0 port2 0 port3 0 port4 ID PORTS -- ----- 1 port5 1 port6 1 port7 1 port8 ID PORTS -- ----- 2 port9 2 port10 2 port11 2 port12 ID PORTS -- ----- 3 port13 3 port14 3 port15 3 port16
-TJ
-TJ
zack
New Contributor

I was told by Fortinet to use port 1. I followed their instructions to the letter. When you say " non Np2 port" that exactly do you mean by NP2 port? I suspect it is possible I could have been using the wrong port, but you would think Fortinet tech support would know which port I should be using... I was referred to: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=10338&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=11183031&stateId=0%200%2011181817 Which also has a chart that says which port to use.
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
(2) FortiGate 300A (clustered) 4.2.9 (1) Fortigate 310B 4.2.9 (1) Fortianalyzer 100C 4.2.4
Top Kudoed Authors