FortiGate HA Syncs Issues

-

 Try to get the output the following commands in both Primary and Secondary Firewalls.

1. Connect the Putty or CLI 

    - get system ha status

    - get system status

    - diag system ha history read

    - diag debug crashlog read | grep 2022

    - config system ha

    - show full

2. Running Debug

    - diag debug reset

    - diag debug application hasync -1

    - diag debug application hatalk -1

    - diag debug console timestamp enable

    - diag debug enable


Note: Keep run the debug to produce the output for 20-30mins.

3. To stop debug:

    - diag debug disable

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-HA-synchronization-issue-cluster-out-of-sync/ta-p/193422

Comments

Post a Comment

Popular posts from this blog

FortiGate-100D: EXT2-fs(sdb1):previous I/O error to superblock detection

-
When you are facing the issues that the kernel errors something like firewall is rebooting auto or outage of power supply accidently. So all the LAN interfaces shut down in the firewall. Problem: The errors will be like this: EXT2-fs(sdb1):previous I/O error to superblock detected. EXT2-fs(sdb1):previous I/O error to superblock detected. EXT2-fs(sdb1):previous I/O error to superblock detected. Troubleshooting Commands: 1) Try to get the debug logs https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-download-debug-log-file-at-different/ta-p/193211 2) Get the result details #get hardware status #get system status #get system performance status # diagnose sys flash list # diagnose autoupdate status # diagnose autoupdate versions # diag debug crashlog read # diagnose hardware sysinfo memory # diagnose hardware sysinfo shm # diagnose hardware sysinfo slab # diagnose debug crashlog read # diagnose hardware deviceinfo disk # diagnose sys session stat Resolution: The issue is res...
Read more

SFTP (CrushFTP serevr) renew Certificate

-
Image
  SFTP (CrushFTP serevr) renew Certificate 1.        Use a certificate issued legitimately from CA (Sectigo) 2.        Generate PFX file via IIS  Manager Ensure the file type is *.pfx Password: star_photostriker 3.        Copy file over to SFTP server 4.        Convert PFX file to jks 5.     keytool -importkeystore -srckeystore mypfxfile.pfx -srcstoretype pkcs12 -destkeystore identity.jks -deststoretype JKS    6.   Login into CrushFTP web console 7.      Go to navigate to Preferences, Encryption and open the SSL tab. Click on the Import Reply button   8.        Input Keystore Path and Keystore Password   9.        Click on the Browse button next to the Import Certificate Authority Reply File and upload the certific...
Read more

Check the cisco device MAC address and IP address

-
 To check the cisco device MAC address and IP address C2960#sh mac address-table interface gi1/0/3  and C2960#sh mac address-table address 2894.0f64.0340  Mac Address Table ------------------------------------------- Vlan    Mac Address       Type        Ports ----    -----------       --------    -----  413    2894.0f64.0340    DYNAMIC     Gi1/0/3 ========================================================= C2960#sh ip arp 2894.0f64.0340 Protocol  Address          Age (min)  Hardware Addr   Type   Interface Internet  191.65.230.30          154   2894.0f64.0340  ARPA   Vlan413
Read more