{"id":79,"date":"2020-07-09T00:18:49","date_gmt":"2020-07-08T22:18:49","guid":{"rendered":"https:\/\/whatifsecu.tech\/?p=79"},"modified":"2020-07-09T00:22:50","modified_gmt":"2020-07-08T22:22:50","slug":"diagnostiquer-les-problemes-de-synchronisation-de-configuration-ha-fortigate-cluster-out-of-sync","status":"publish","type":"post","link":"https:\/\/whatifsecu.tech\/?p=79","title":{"rendered":"Diagnostiquer les probl\u00e8mes de synchronisation de configuration HA – FortiGate cluster out-of-sync"},"content":{"rendered":"\n

\/!\\ en cas de vdoms activ\u00e9s\u202f: Les\ncommandes qui suivent sont entr\u00e9es en mode \u201cconfig global\u201d  
\n 
\nget system ha status<\/strong>\u202f\u202f\u202f\u202f\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <–<\/strong>\u202f<\/strong>Pour voir les\ninformations d\u00e9taill\u00e9es sur l\u2019\u00e9tat du cluster ainsi que la raison de la\nderni\u00e8re bascule  
\n 
\nPrim-FW (global)\n# get sys ha status 
\nHA Health Status: OK 
\nModel: FortiGate-VM64-KVM 
\nMode: HA A-P 
\nGroup: 9 
\nDebug: 0 
\nCluster Uptime: 14 days 5:9:44 
\nCluster state change time: 2019-06-13 14:21:15 <\/p>\n\n\n\n

Raison\ndes derni\u00e8res bascules: 
\n <\/p>\n\n\n\n

<2019\/06\/13 14:21:15> FGVMXXXXXXXXXX44 is\nselected as the master because it has the largest value of uptime. 
\n<2019\/06\/13 14:15:46> FGVMXXXXXXXXXX46 is\nselected as the master because it has the largest value of uptime. 
\n<2019\/06\/12 11:17:04> FGVMXXXXXXXXXX44 is\nselected as the master because it has the largest value of override priority. 
\nses_pickup: enable, ses_pickup_delay=disable 
\noverride: disable <\/p>\n\n\n\n

V\u00e9rifier\nla synchronisation de la configuration de chaque membre du cluster: <\/p>\n\n\n\n

 
\nPrim-FW(global)#diag\nsys ha checksum cluster<\/strong> 
\n 
\n==================\nFGVMXXXXXXXXXX44 ================== 
\nis_manage_master()=1, is_root_master()=1 
\ndebugzone 
\nglobal: c5 33 93 23 26 9f 4d 79 ed 5f 29 fa 7a 8c c9\n10 
\nroot: d3 b5 fc 60 f3\nf0 f0 d0 ea e4 a1 7f 1d 17 05 fc 
\nCust-A: 84 af 8f 23 b5 31 ca 32 c1 0b f2 76\nd2 57 d1 bc 
\nall: 04 ae 37 7e dc 84 aa a4 42 3d db 3c a2\n09 b0 60 
\n 
\nchecksum 
\nglobal: c5 33 93 23 26 9f 4d 79 ed 5f 29 fa 7a 8c c9\n10 
\nroot: d3 b5 fc 60 f3\nf0 f0 d0 ea e4 a1 7f 1d 17 05 fc 
\nCust-A: 84 af 8f 23 b5 31 ca 32 c1 0b f2 76\nd2 57 d1 bc 
\nall: 04 ae 37 7e dc 84 aa a4 42 3d db 3c a2\n09 b0 60 
\n 
\n==================\nFGVMXXXXXXXXXX46 ================== 
\nis_manage_master()=0, is_root_master()=0 
\ndebugzone 
\nglobal: c5 33 93 23 26 9f 4d 79 ed 5f 29 fa 7a 8c c9\n10 
\nroot: d3 b5 fc 60 f3 f0 f0 d0 ea e4\na1 7f 1d 17 05 fc 
\nCust-A: 84 af 8f 23 b5 31 ca 32 c1 0b f2 76\nd2 57 d1 bc 
\nall: 04 ae 37 7e dc 84 aa a4 42 3d db 3c a2\n09 b0 60 
\n 
\nchecksum 
\nglobal: c5 33 93 23 26 9f 4d 79 ed 5f 29 fa 7a 8c c9\n10 
\nroot: d3 b5 fc 60 f3\nf0 f0 d0 ea e4 a1 7f 1d 17 05 fc 
\nCust-A: 84 af 8f 23 b5 31 ca 32 c1 0b f2 76\nd2 57 d1 bc 
\nall: 04 ae 37 7e dc 84 aa a4 42 3d db 3c a2\n09 b0 60 <\/p>\n\n\n\n

 
\nS\u2019il n\u2019y a pas de mismatch, la\nconfiguration est synchronis\u00e9e. Auquel cas, un probl\u00e8me de cluster remont\u00e9\nvia la GUI sera un bug d\u2019affichage. <\/p>\n\n\n\n

S\u2019il y a\nun mismatch, voici comment voir o\u00f9 le mismatch se\nsitue\u202f: <\/p>\n\n\n\n

1.v\u00e9rifier dans quelle\u00a0grande\u00a0partie\u00a0de la conf le mismatch se\u00a0trouve:\u00a0
#\u00a0diag\u00a0sys ha checksum cluster<\/strong>\u00a0
================== FGT1 =================\u00a0
is_manage_master()=0,\u00a0is_root_master()=0\u00a0
debugzone\u00a0
global: : 79 24 76 8a a8 03 9a 81 dc c4 3c f8 96 72 59 11\u00a0<\/strong>
root:\u00a0cf\u00a085 55\u00a0fe\u00a0a7 e5 7c 6f a6 88 e5 a9\u00a0ea\u00a026 e6 92\u00a0
all: f4 62 b2\u00a0ce\u00a081 9a c9 04 8f 67 07\u00a0ec\u00a0a7 44 60 1f\u00a0
checksum\u00a0
global: : 79 24 76 8a a8 03 9a 81 dc c4 3c f8 96 72 59 11\u00a0
root:\u00a0cf\u00a085 55\u00a0fe\u00a0a7 e5 7c 6f a6 88 e5 a9\u00a0ea\u00a026 e6 92\u00a0
all: f4 62 b2\u00a0ce\u00a081 9a c9 04 8f 67 07\u00a0ec\u00a0a7 44 60 1f\u00a0
================== FGT2 ==================\u00a0
is_manage_master()=1,\u00a0is_root_master()=1\u00a0
debugzone\u00a0
global: 89 f2 f0 0b e8 eb 0d\u00a0ee\u00a0f8 55 8b 47 27 7a 27 1e\u00a0<\/strong>
root:\u00a0cf\u00a085 55\u00a0fe\u00a0a7 e5 7c 6f a6 88 e5 a9\u00a0ea\u00a026 e6 92\u00a0
all: a7 8d cc c7 32 b5 81 a2 55 49 52 21 57 f9 3c 3b\u00a0
checksum\u00a0
global: 89 f2 f0 0b e8 eb 0d\u00a0ee\u00a0f8 55 8b 47 27 7a 27 1e\u00a0
root:\u00a0cf\u00a085 55\u00a0fe\u00a0a7 e5 7c 6f a6 88 e5 a9\u00a0ea\u00a026 e6 92\u00a0
all: a7 8d cc c7 32 b5 81 a2 55 49 52 21 57 f9 3c 3b\u00a0<\/p>\n\n\n\n

2. donc\ncomme on le voit il y a une diff\u00e9rence sur \u00ab\u202fglobal\u202f\u00bb. Il faut donc\naller sur chaque membre du cluster et regarder plus en d\u00e9tail cette\npartie. <\/p>\n\n\n\n

# diag sys ha checksum show\n<VDOM_NAME><\/strong> <\/p>\n\n\n\n

Par exemple: <\/p>\n\n\n\n

# diag sys\nha checksum show global<\/strong> <\/p>\n\n\n\n

Donc ici\n(on peut changer de membre du cluster avec # exec ha manage <ID_membre_cluster> <\/strong>ou # exec ha\nmanage <ID_membre_cluster> <login_admin><\/strong> : <\/p>\n\n\n\n
\u202f<\/strong>\u00a0 FGT_1 #diag sys ha checksum\u00a0show\u00a0global<\/strong>\u00a0
system.global: d6c216d8449d75b2cd80110fa02a85e5<\/strong>\u00a0 system.accprofile: 7df6f055a28e5d5216c4d2c2b3ee77d1\u00a0 system.npu: 7df6f055a28e5d5216c4d2c2b3ee77d1\u00a0 system.vdom-link: 7df6f055a28e5d5216c4d2c2b3ee77d1\u00a0 wireless-controller.global: 7df6f055a28e5d5216c4d2c2b3ee77d1\u00a0 wireless-controller.vap: cda65c180c25050eb83398fa23ab7fd1\u00a0 system.switch-interface: cda65c180c25050eb83398fa23ab7fd1\u00a0 system.interface: 56f2362fd69f51a2b6fc22a008c0c755\u00a0 system.password-policy: 56f2362fd69f51a2b6fc22a008c0c755\u00a0 system.sms-server: 56f2362fd69f51a2b6fc22a008c0c755\u00a0 system.fsso-polling: af9c2b4f63e40551e33eabd64436fb3e\u00a0 system.ha: ddfeff2ae037f615fbd83110169b70d2\u00a0 <\/td>		 \u202f<\/strong>\u00a0 FGT_2 #diag sys ha checksum\u00a0show\u00a0global<\/strong>\u00a0
system.global: d6c216d8449d75b2cd80110fa02a84e5<\/strong>\u00a0 system.accprofile: 7df6f055a28e5d5216c4d2c2b3ee77d1\u00a0 system.npu: 7df6f055a28e5d5216c4d2c2b3ee77d1\u00a0 system.vdom-link: 7df6f055a28e5d5216c4d2c2b3ee77d1\u00a0 wireless-controller.global: 7df6f055a28e5d5216c4d2c2b3ee77d1\u00a0 wireless-controller.vap: cda65c180c25050eb83398fa23ab7fd1\u00a0 system.switch-interface:cda65c180c25050eb83398fa23ab7fd1\u00a0 system.interface: 56f2362fd69f51a2b6fc22a008c0c755\u00a0 system.password-policy: 56f2362fd69f51a2b6fc22a008c0c755\u00a0 system.sms-server: 56f2362fd69f51a2b6fc22a008c0c755\u00a0 system.fsso-polling: af9c2b4f63e40551e33eabd64436fb3e\u00a0 system.ha: ddfeff2ae037f615fbd83110169b70d2\u00a0 \u202f<\/strong>\u00a0 <\/td><\/tr><\/tbody><\/table>\n\n\n\n

On voit\nici que c\u2019est dans \u00ab\u202fadmin settings\u202f\u00bb <\/p>\n\n\n\n

3.on peut\nm\u00eame aller encore plus loin avec\u202f: <\/p>\n\n\n\n

# diag sys ha\nchecksum show global <object.name><\/strong> <\/p>\n\n\n\n

Par exemple: <\/p>\n\n\n\n
FGT1 #diag sys ha checksum show global\u00a0system.global<\/strong>\u00a0
[admin-server-cert]=’Fortinet_Factory’: f9d23d8f459c415d1742630c4c0cd99d\u00a0
[admintimeout]=’480′: 8041fc04d56bd268f40fafc37b5fd078\u00a0<\/strong>
[alias]=’FGVM010000087496′: a47b05f1b3646431fb078469cfca3225\u00a0
[fgd-alert-subscription]=’advisory latest-threat’: e15ed9aae8a488d992774994c36566b1\u00a0
[timezone]=’04’: 5af081b7089c3f69917ea509f3cb5e6d\u00a0 <\/td>		 FGT2 #diag sys ha checksum show global\u00a0system.global<\/strong>\u00a0
[admin-server-cert]=’Fortinet_Factory’: f9d23d8f459c415d1742630c4c0cd99d\u00a0
[admintimeout]=’380′: 8041fc04d56bd268f40fafc37b5fd079\u00a0<\/strong>
[alias]=’FGVM010000087496′: a47b05f1b3646431fb078469cfca3225\u00a0
[fgd-alert-subscription]=’advisory latest-threat’: e15ed9aae8a488d992774994c36566b1\u00a0
[timezone]=’04’: 5af081b7089c3f69917ea509f3cb5e6d\u00a0 <\/td><\/tr><\/tbody><\/table>\n\n\n\n

4. Donc\nl\u2019admin timeout est diff\u00e9rent. Un changement de conf sur le membre qui a une\nmauvaise valeur corrigera le souci.  <\/p>\n\n\n\n

A noter\nque n\u2019importe quel changement d\u00e9clenchera une nouvelle synchro de\nconfiguration. <\/p>\n\n\n\n

A ce\nstade, on pourra refaire une synchro de configuration avec la commande\u202fd\u00e9j\u00e0\nplus haut : <\/p>\n\n\n\n

# diag sys ha checksum cluster<\/strong> <\/p>\n\n\n\n

================== FGT1 ================= 
\nis_manage_master()=0, is_root_master()=0 
\n 
\ndebugzone 
\n 
\nglobal: : 79 24 76\n8a a8 03 9a 81 dc c4 3c f8 96 72 59 11 
\nroot: cf 85 55 fe a7 e5 7c 6f a6\n88 e5 a9 ea 26 e6 92 
\nall: f4 62 b2 ce 81 9a c9 04 8f 67\n07 ec a7 44 60 1f 
\n 
\nchecksum 
\n 
\nglobal: : 79 24 76\n8a a8 03 9a 81 dc c4 3c f8 96 72 59 11 
\nroot: cf 85 55 fe a7 e5 7c 6f a6\n88 e5 a9 ea 26 e6 92 
\nall: f4 62 b2 ce 81 9a c9 04 8f 67\n07 ec a7 44 60 1f 
\n 
\n==================\nFGT2 ================== 
\n 
\nis_manage_master()=1, is_root_master()=1 
\n 
\ndebugzone 
\n 
\nglobal: : 79 24 76\n8a a8 03 9a 81 dc c4 3c f8 96 72 59 11 
\nroot: cf 85 55 fe a7 e5 7c 6f a6\n88 e5 a9 ea 26 e6 92 
\nall: f4 62 b2 ce 81 9a c9 04 8f 67\n07 ec a7 44 60 1f 
\n 
\nchecksum 
\n 
\nglobal: : 79 24 76\n8a a8 03 9a 81 dc c4 3c f8 96 72 59 11 
\nroot: cf 85 55 fe a7 e5 7c 6f a6\n88 e5 a9 ea 26 e6 92 
\nall: f4 62 b2 ce 81 9a c9 04 8f 67\n07 ec a7 44 60 1f 
\n <\/p>\n\n\n\n

En cas\nde probl\u00e8mes de mismatch compl\u00e9mentaire, tenter\u202fde recalculer\nles checksums: <\/p>\n\n\n\n

#diagnose sys ha checksum recalculate\n[<vdom-name> | global]<\/strong> <\/p>\n\n\n\n

 
\nEn compl\u00e9ment, pour diagnostiquer les\nprobl\u00e8mes de HA compl\u00e9mentaires : 
\n <\/p>\n\n\n\n

diag debug app hasync 255<\/strong> 
\ndiag debug enable<\/strong> 
\nexecute ha synchronize start<\/strong> 
\ndiagnose debug application hatalk -1<\/strong> <\/p>\n\n\n\n

Lancer\nles commandes suivantes pour v\u00e9rifier les mismatches\u202f: <\/p>\n\n\n\n

diag debug config-error-log read<\/strong>\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f<\/strong> <\/strong>\u202f\u202f<\/strong> <\/strong>\u202f\u202f<\/strong><–<\/strong>\u202f<\/strong>(1)<\/strong> 
\ndiag hardware device disk<\/strong>\u202f\u202f\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f\u202f<\/strong><–<\/strong>\u202f<\/strong>(2)<\/strong> 
\nshow sys storage <\/strong>\u202f\u202f\u202f<\/strong> <\/strong>\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f\u202f<\/strong><–<\/strong>\u202f<\/strong>(2)<\/strong> 
\nshow wanopt storage<\/strong>\u202f\u202f\u202f<\/strong> <\/strong>\u202f\u202f\u202f\u202f\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f<\/strong> <\/strong>\u202f\u202f<\/strong><–<\/strong>\u202f<\/strong>(2)<\/strong> <\/p>\n\n\n\n

  1. Pour v\u00e9rifier les lignes de configuration\nqui ont mal \u00e9t\u00e9 comprises par le FortiGate  <\/li>
  2. La taille des\ndisques doit correspondre <\/li><\/ol>\n","protected":false},"excerpt":{"rendered":"

    \/!\\ en cas de vdoms activ\u00e9s\u202f: Les commandes qui suivent sont entr\u00e9es en mode \u201cconfig global\u201d     get system ha status\u202f\u202f\u202f\u202f\u202f \u202f \u202f \u202f \u202f \u202f \u202f \u202f \u202f \u202f \u202f \u202f <–\u202fPour voir les informations d\u00e9taill\u00e9es sur l\u2019\u00e9tat du cluster ainsi que la raison de la… Continue Reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-79","post","type-post","status-publish","format-standard","hentry","category-fortinet"],"_links":{"self":[{"href":"https:\/\/whatifsecu.tech\/index.php?rest_route=\/wp\/v2\/posts\/79","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/whatifsecu.tech\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/whatifsecu.tech\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/whatifsecu.tech\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/whatifsecu.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=79"}],"version-history":[{"count":3,"href":"https:\/\/whatifsecu.tech\/index.php?rest_route=\/wp\/v2\/posts\/79\/revisions"}],"predecessor-version":[{"id":82,"href":"https:\/\/whatifsecu.tech\/index.php?rest_route=\/wp\/v2\/posts\/79\/revisions\/82"}],"wp:attachment":[{"href":"https:\/\/whatifsecu.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=79"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/whatifsecu.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=79"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/whatifsecu.tech\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=79"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}