Viewing more details about HA cluster synchronization
You can use the diagnose sys ha checksum show command to display the debugzone and configuration checksums for the FortiGate-6000 in the cluster that you have logged in to.
diagnose sys ha checksum show is_manage_primary()=1, is_root_primary()=1 debugzone global: 7e 06 79 02 65 a9 ea e3 68 58 73 c2 33 d0 16 f1 root: 43 2c ee 2c f1 b3 b2 13 ff 37 34 5e 86 11 dc bf mgmt-vdom: 9c 7d 58 9f 81 4b b7 4e ed 2a c3 02 34 b4 7c 63 all: 0b 16 f2 e4 e2 89 eb a1 bf 8f 15 9b e1 4e 3b f2 checksum global: 7e 06 79 02 65 a9 ea e3 68 58 73 c2 33 d0 16 f1 root: 43 2c ee 2c f1 b3 b2 13 ff 37 34 5e 86 11 dc bf mgmt-vdom: 9c 7d 58 9f 81 4b b7 4e ed 2a c3 02 34 b4 7c 63 all: 0b 16 f2 e4 e2 89 eb a1 bf 8f 15 9b e1 4e 3b f2
The first line of this example output indicates that the command is displaying information for the primary FortiGate-6000. This command output then shows debugzone and checksum information for the management board. You can verify that the management board is synchronized because both sets of checksums match.
Each set of checksums includes a checksum for the global configuration, for each VDOM (in this case there are two VDOMs: root and mgmt-vdom), and a checksum for the complete configuration (all).
You can use the diagnose sys ha checksum cluster command to display the debugzone and configuration checksums for both FortiGate-6000s in the cluster. The command output also indicates which FortiGate-6000 is the primary (is_manage_primary()=1) and the secondary (is_manage_primary()=0). If the cluster is synchronized, both FortiGate-6000s will have the same checksums.
diagnose sys ha checksum cluster ================== F6KF31T018900158 ================== is_manage_primary()=0, is_root_primary()=0 debugzone global: b7 df c2 39 be 5c 3f ac cb 6f 53 20 5a b6 2d 98 root: 1b 71 bc 50 80 15 10 5c 7e 79 38 73 30 dd 56 32 mgmt-vdom: 79 f5 78 e4 ad 6d 39 b8 8e 96 84 21 18 28 18 64 all: 49 63 81 37 c1 a2 78 95 46 44 08 ff 5d 2e 44 a7 checksum global: b7 df c2 39 be 5c 3f ac cb 6f 53 20 5a b6 2d 98 root: 1b 71 bc 50 80 15 10 5c 7e 79 38 73 30 dd 56 32 mgmt-vdom: 79 f5 78 e4 ad 6d 39 b8 8e 96 84 21 18 28 18 64 all: 49 63 81 37 c1 a2 78 95 46 44 08 ff 5d 2e 44 a7 ================== F6KF31T018900139 ================== is_manage_primary()=1, is_root_primary()=1 debugzone global: b7 df c2 39 be 5c 3f ac cb 6f 53 20 5a b6 2d 98 root: 1b 71 bc 50 80 15 10 5c 7e 79 38 73 30 dd 56 32 mgmt-vdom: 79 f5 78 e4 ad 6d 39 b8 8e 96 84 21 18 28 18 64 all: 49 63 81 37 c1 a2 78 95 46 44 08 ff 5d 2e 44 a7 checksum global: b7 df c2 39 be 5c 3f ac cb 6f 53 20 5a b6 2d 98 root: 1b 71 bc 50 80 15 10 5c 7e 79 38 73 30 dd 56 32 mgmt-vdom: 79 f5 78 e4 ad 6d 39 b8 8e 96 84 21 18 28 18 64 all: 49 63 81 37 c1 a2 78 95 46 44 08 ff 5d 2e 44 a7
Finally, you can also log into the CLI of each FortiGate-6000 in the cluster and use the diagnose sys confsync showcsum command to confirm that the configurations of the management board and the FPCs in each FortiGate-6000 are synchronized.
The output of the command will also show that the ha checksums are the same for both FortiGate-6000s, but the confsync checksums are different. This occurs because some parts of the configuration are not synchronized by HA so each FortiGate-6000 will have a different configuration and different confsync checksums.
See Viewing more details about FortiGate-6000 synchronization for details about the diagnose sys confsync showcsum command.