Viewing more details about HA cluster synchronization
You can use the diagnose sys ha checksum show command to display the debugzone and configuration checksums for the FortiGate-7000 in the cluster that you have logged in to.
diagnose sys ha checksum show is_manage_master()=1, is_root_master()=1 debugzone global: 7e 06 79 02 65 a9 ea e3 68 58 73 c2 33 d0 16 f1 root: 43 2c ee 2c f1 b3 b2 13 ff 37 34 5e 86 11 dc bf mgmt-vdom: 9c 7d 58 9f 81 4b b7 4e ed 2a c3 02 34 b4 7c 63 all: 0b 16 f2 e4 e2 89 eb a1 bf 8f 15 9b e1 4e 3b f2 checksum global: 7e 06 79 02 65 a9 ea e3 68 58 73 c2 33 d0 16 f1 root: 43 2c ee 2c f1 b3 b2 13 ff 37 34 5e 86 11 dc bf mgmt-vdom: 9c 7d 58 9f 81 4b b7 4e ed 2a c3 02 34 b4 7c 63 all: 0b 16 f2 e4 e2 89 eb a1 bf 8f 15 9b e1 4e 3b f2
The first line of this example output indicates that the command is displaying information for the primary FortiGate-7000. This command output then shows debugzone and checksum information for the primary FIM. You can verify that the primary FIM is synchronized because both sets of checksums match.
Each set of checksums includes a checksum for the global configuration, for each VDOM (in this case there are two VDOMs: root and mgmt-vdom), and a checksum for the complete configuration (all).
You can use the diagnose sys ha checksum cluster command to display the debugzone and configuration checksums for both FortiGate-7000s in the cluster. The command output also indicates which FortiGate-7000 is the primary (is_manage_master()=1) and the secondary (is_manage_master()=0). If the cluster is synchronized, both FortiGate-7000s will have the same checksums.
diagnose sys ha checksum cluster ================== FG74E43E17000073 ================== is_manage_master()=1, is_root_master()=1 debugzone global: 7e 06 79 02 65 a9 ea e3 68 58 73 c2 33 d0 16 f1 root: 43 2c ee 2c f1 b3 b2 13 ff 37 34 5e 86 11 dc bf mgmt-vdom: 9c 7d 58 9f 81 4b b7 4e ed 2a c3 02 34 b4 7c 63 all: 0b 16 f2 e4 e2 89 eb a1 bf 8f 15 9b e1 4e 3b f2 checksum global: 7e 06 79 02 65 a9 ea e3 68 58 73 c2 33 d0 16 f1 root: 43 2c ee 2c f1 b3 b2 13 ff 37 34 5e 86 11 dc bf mgmt-vdom: 9c 7d 58 9f 81 4b b7 4e ed 2a c3 02 34 b4 7c 63 all: 0b 16 f2 e4 e2 89 eb a1 bf 8f 15 9b e1 4e 3b f2 ================== FG74E43E17000065 ================== is_manage_master()=0, is_root_master()=0 debugzone global: 7e 06 79 02 65 a9 ea e3 68 58 73 c2 33 d0 16 f1 root: 43 2c ee 2c f1 b3 b2 13 ff 37 34 5e 86 11 dc bf mgmt-vdom: 9c 7d 58 9f 81 4b b7 4e ed 2a c3 02 34 b4 7c 63 all: 0b 16 f2 e4 e2 89 eb a1 bf 8f 15 9b e1 4e 3b f2 checksum global: 7e 06 79 02 65 a9 ea e3 68 58 73 c2 33 d0 16 f1 root: 43 2c ee 2c f1 b3 b2 13 ff 37 34 5e 86 11 dc bf mgmt-vdom: 9c 7d 58 9f 81 4b b7 4e ed 2a c3 02 34 b4 7c 63 all: 0b 16 f2 e4 e2 89 eb a1 bf 8f 15 9b e1 4e 3b f2
Finally, you can also log into the CLI of each FortiGate-7000 in the cluster and use the diagnose sys confsync showcsum command to confirm that the configurations of the FIMs and FPMs in each FortiGate-7000 are synchronized.
The output of the command will also show that the ha checksums are the same for both FortiGate-7000s, but the confsync checksums are different. This occurs because some parts of the configuration are not synchronized by HA so each FortiGate-7000 will have a different configuration and different confsync checksums.
See Viewing more details about FortiGate-7000 synchronization for details about the diagnose sys confsync showcsum command.