Problem: Two FortiGate firewall show “not synchonized” in the HA status.
Discussion: the problem with this is, that FortiGate does not show why it fails. I found no log file with a reasonable error message. So I tried to synchronize the config myself, which is exactly what should NOT be necessary when using HA synchronization.
Solution: When an ipsec-phase1 setting in the master is removed while the slave is not online, the ipsec-phase1 removal fails during synchronization. Why Fortinet, doesn’t your box log this? Removing the phase1-section by hand did not work ether:
FortiGate-Master # execute ha manage 1
FortiGate-Slave $ config vpn ipsec phase1-interface
FortiGate-Slave (phase1-interface) $ delete VPN-PEER
This phase1-interface is currently used
command_cli_delete:5937 delete table entry VPN-PEER unset oper error ret=-23
Command fail. Return code -23
Like with most cheap software I had to reboot the slave, and then I could remove the phase1-interface section, and then the synchronization worked again.
I don’t remember if I ever had to reboot a Cisco or Linux box to fix a bug.
Version: FortiGate 6.0.4