highHA & Clustering

Troubleshooting FortiGate HA synchronization and verifying cluster configuration

Q: Troubleshooting FortiGate HA synchronization and verifying cluster configuration

1. During initial HA setup, monitor the console of the unit joining as the Secondary. A successful cluster formation displays a sequence similar to: 2. From the Primary, check HA membership and roles: Example Primary output: 3. Check the same status from the Secondary: Example Secondary output: 4. If direct Secondary access is unavailable, list the subsidiary unit IDs from the Primary: Then connect to the Secondary CLI, where is the listed subsidiary unit and is the administrator account: 5. On the Primary, calculate the cluster configuration checksums: Example for a multiple-VDOM cluster: 6. Run the same checksum command on the Secondary: Example synchronized Secondary output: 7. Compare every checksum, including , each VDOM, and . If any value differs, force configuration synchronization: The available synchronization commands include: 8. If synchronization problems continue, open a Fortinet TAC ticket and attach the HA status and checksum information collected from both units.

Confirmed 8/8/2026

Problem

Determine whether all FortiGate units in a high availability (HA) cluster have synchronized successfully and are using the same configuration.

Symptoms

A newly joined Secondary reports that its configuration is not synchronized with the Primary, or the Primary and Secondary return different configuration checksums.

Environment

FortiGate HA clusters, including active-passive (a-p) deployments with multiple VDOMs. When VDOMs are enabled, run all commands in global mode.

Root Cause

During initial cluster formation, a new Secondary must copy the Primary configuration. In an established cluster, differing Primary and Secondary checksums indicate a configuration synchronization problem.

Solution

During initial HA setup, monitor the console of the unit joining as the Secondary. A successful cluster formation displays a sequence similar to:

secondary's configuration is not in sync with primary's, sequence:0
secondary's configuration is not in sync with primary's, sequence:1
secondary's configuration is not in sync with primary's, sequence:2
secondary's configuration is not in sync with primary's, sequence:3
secondary's configuration is not in sync with primary's, sequence:4
secondary starts to sync with primary
logout all admin users
secondary succeeded to sync with primary

From the Primary, check HA membership and roles:

get system ha status

Example Primary output:

Model: 300
Mode: a-p
Group: 30
Debug: 0
ses_pickup: disable
Primary:200 FGT300-5 FG300A3906550380 0
Secondary :128 FGT300-2 FG300A2904500186 1
number of vcluster: 1
vcluster 1: work 169.254.0.1
Primary:0 FG300A3906550380
Secondary :1 FG300A2904500186

Check the same status from the Secondary:

get system ha status

Example Secondary output:

Model: 300
Mode: a-p
Group: 30
Debug: 0
ses_pickup: disable
Secondary:128 FGT300-2 FG300A2904500186 1
Primary:200 FGT300-5 FG300A3906550380 0
number of vcluster: 1
vcluster 1: standby 169.254.0.1
Secondary:1 FG300A2904500186
Primary:0 FG300A3906550380

If direct Secondary access is unavailable, list the subsidiary unit IDs from the Primary:

execute ha manage ?

Then connect to the Secondary CLI, where <id> is the listed subsidiary unit and <admin name> is the administrator account:

execute ha manage <id> <admin name>

On the Primary, calculate the cluster configuration checksums:

diagnose sys ha checksum cluster

Example for a multiple-VDOM cluster:

global: e5 45 87 ff 9d 4b d5 dc 37 98 ce bd 53 c0 75 70
root: f3 a7 72 9a f8 8a 42 f3 80 77 89 a3 eb d9 09 2b
LAN: a5 f8 cf 4c 98 3b 25 b7 22 3b 17 f6 76 8e b0 3c
INTERNET: f9 32 66 b4 d6 6d 2e 0a 42 59 11 c2 4c 85 53 f8
DMZ: 30 96 97 69 ff 07 32 bd 6c 84 0c 5c 4a 13 78 92
all: 4b a1 24 73 2b 3a 86 71 a8 9a 98 22 15 1c 76 65
checksum
global: e5 45 87 ff 9d 4b d5 dc 37 98 ce bd 53 c0 75 70
root: f3 a7 72 9a f8 8a 42 f3 80 77 89 a3 eb d9 09 2b
LAN: a5 f8 cf 4c 98 3b 25 b7 22 3b 17 f6 76 8e b0 3c
INTERNET: f9 32 66 b4 d6 6d 2e 0a 42 59 11 c2 4c 85 53 f8
DMZ: 30 96 97 69 ff 07 32 bd 6c 84 0c 5c 4a 13 78 92
all: 4b a1 24 73 2b 3a 86 71 a8 9a 98 22 15 1c 76 65

Run the same checksum command on the Secondary:

diagnose sys ha checksum cluster

Example synchronized Secondary output:

global: e5 45 87 ff 9d 4b d5 dc 37 98 ce bd 53 c0 75 70
root: f3 a7 72 9a f8 8a 42 f3 80 77 89 a3 eb d9 09 2b
LAN: a5 f8 cf 4c 98 3b 25 b7 22 3b 17 f6 76 8e b0 3c
INTERNET: f9 32 66 b4 d6 6d 2e 0a 42 59 11 c2 4c 85 53 f8
DMZ: 30 96 97 69 ff 07 32 bd 6c 84 0c 5c 4a 13 78 92
all: 4b a1 24 73 2b 3a 86 71 a8 9a 98 22 15 1c 76 65
checksum
global: e5 45 87 ff 9d 4b d5 dc 37 98 ce bd 53 c0 75 70
root: f3 a7 72 9a f8 8a 42 f3 80 77 89 a3 eb d9 09 2b
LAN: a5 f8 cf 4c 98 3b 25 b7 22 3b 17 f6 76 8e b0 3c
INTERNET: f9 32 66 b4 d6 6d 2e 0a 42 59 11 c2 4c 85 53 f8
DMZ: 30 96 97 69 ff 07 32 bd 6c 84 0c 5c 4a 13 78 92
all: 4b a1 24 73 2b 3a 86 71 a8 9a 98 22 15 1c 76 65

Compare every checksum, including global, each VDOM, and all. If any value differs, force configuration synchronization:

execute ha synchronize start

The available synchronization commands include:

execute ha synchronize start
execute ha synchronize stop

If synchronization problems continue, open a Fortinet TAC ticket and attach the HA status and checksum information collected from both units.

Verification

Confirm that get system ha status identifies the expected Primary and Secondary roles and that the Primary shows work while the Secondary shows standby for the vcluster. Verify that the values returned by diagnose sys ha checksum cluster match on both units for global, every VDOM, and all. During initial formation, the message secondary succeeded to sync with primary confirms that the Secondary completed synchronization.

Community rating

— / 5 (0)

Discussion (0)

No comments yet.