question

phantomscribe avatar image
0 Likes"
phantomscribe asked

How to debug when FortiGate HA is out of sync?

When HA is out of sync, the checksum shows which VDOM has the difference. What additional debug commands are there to find which CLI config caused the problem?

FortiGateHigh Availability
· 2
10 |600

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

pingmemaybe avatar image pingmemaybe ♦♦ commented ·

It may happen when checksum seems all correct but due to VDOM index ordering, some features, like the RADIUS server database, refuse to sync.

0 Likes 0 ·
firsthop avatar image firsthop ♦♦ pingmemaybe ♦♦ commented ·
It's still quite a corner case, though. It's extremely unlikely that the checksums are the same but the FGT configs are different.
0 Likes 0 ·

1 Answer

·
stylus avatar image
0 Likes"
stylus answered

First run the command:

diagnose sys ha checksum show

For example:

FGC_VM_33 # diagnose sys ha checksum show
is_manage_primary()=1, is_root_primary()=1
debugzone
global: 23 f9 c2 84 88 5f a6 01 42 b9 1a 74 06 25 bd b5
root: b2 d9 14 d0 7c 03 69 88 a7 4e aa f4 fa 9c 17 2b
all: 58 33 7e 0c 4e 34 39 d4 08 fa 85 2f d6 45 0a cc
checksum
global: 23 f9 c2 84 88 5f a6 01 42 b9 1a 74 06 25 bd b5
root: b2 d9 14 d0 7c 03 69 88 a7 4e aa f4 fa 9c 17 2b
all: 58 33 7e 0c 4e 34 39 d4 08 fa 85 2f d6 45 0a cc

Review the output to see if the checksum differs.

Then, on both VDOMs, run the command:

diagnose sys ha checksum show <vdomname>

Compare the difference.

FortiGate HA gets out of sync when the sync process is blocked or if the checksum entry has a mismatch.

· 2
10 |600

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

phantomscribe avatar image phantomscribe ♦♦ commented ·
Is there another command to show the CLI config file?
0 Likes 0 ·

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 10 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

Welcome to FortiAnswers

FortiAnswers is the space dedicated to FortiSASE and FortiOS questions and suggestions.

  • Please review the Community guidelines
  • If you are a moderator, please refer to the Moderation guidelines
  • If something in the above guidelines is unclear, please post your question to the Community Feedback space or the Moderators' space