FortiExpert logoFortiExpert
Sign in
← Back to knowledge base
highHA & Clustering

Troubleshooting HA Out-of-Sync Status Caused by a Firewall Policy Mismatch

Confirmed 8/8/2026

Problem

A FortiGate HA cluster reports that the secondary unit is out of synchronization because the firewall policy configuration differs between cluster members.

Symptoms

In **System -> HA**, the secondary FortiGate appears out of sync. Hovering over the synchronization status displays `firewall.policy` as the configuration area causing the mismatch.

Environment

FortiGate in an HA cluster.

Root Cause

One or more firewall policies have different checksums on the FortiGate cluster members. The ID associated with a checksum difference corresponds to the firewall policy ID.

Solution

  1. In the GUI, go to System -> HA and confirm that the secondary FortiGate is out of sync.

  2. Hover over the synchronization status and verify that firewall.policy is identified as the source of the mismatch.

  3. On both FortiGate units in the cluster, run the following command for the affected VDOM:

diagnose sys ha checksum show <vdom_name> firewall.policy

For example, to inspect the root VDOM, run:

diagnose sys ha checksum show root firewall.policy

  1. Compare the policy checksums returned by each FortiGate.

  2. Identify every ID with a different checksum. Each referenced ID is the corresponding firewall policy ID. For example, an ID of 9 indicates firewall policy ID 9.

  3. Review and edit each nonmatching firewall policy to remove the configuration differences between the HA members.

  4. After correcting all discrepancies, allow the HA pair to synchronize again.

Verification

Return to System -> HA and confirm that the secondary FortiGate no longer shows an out-of-sync status. If necessary, rerun diagnose sys ha checksum show <vdom_name> firewall.policy on both units and verify that the firewall policy checksums match.

Tags

No tags yet.

Community rating

— / 5 (0)

Discussion (0)

    No comments yet.