Symptom

One or more of the below symptoms can be observed: 1. ngfw.rules mismatch between active and standby after upgrade. 2. After upgrade, App sync may fail on the standby and it will go to disabled state.

Conditions

All of the below conditions have to be met to hit this issue: 1. Before an upgrade, configure RA VPN with multiple any-connect packages. Followed by multiple other policy deployment. 2. One node goes out of HA and joins back. OR one node is rebooted. 3. After the node join, HA is upgraded. Note that all these three conditions have to be met to hit this issue.

Workaround

After the upgrade, if ngfw rules are not matching, perform a deployment from FMC. That will bring the rules to be in sync. After the upgrade, if node is going to disabled state, then perform a deployment from FMC when only Active device is there. After the deployment is successful on the active node, in the SFR CLI of Disabled node, perform "configure high-availability resume".

Further Problem Description