The upgrade itself was supposed to be boring.
Two FortiGates in HA. Code bump on the pair. The kind of window you schedule because the vendor said you should, not because anything is on fire. I have done this dance enough times I do not need the notes in front of me. Watch the session sync. Watch the heartbeat. Fail over on purpose. Fail back. Close the ticket.
Except the pair did not come back together.
After the code landed, the HA relationship fell out of sync and stayed there. Not a brief split. Not a checksum that caught up on the next hello. They would not realign. I tried the things you try. Fortinet support tried the things they try. None of it took. The cluster was done talking to itself.
When you have exhausted the polite options on a FortiGate HA pair, the remaining option is ugly and usually correct. Factory-reset the secondary. Rebuild the HA parameters by hand. Let it pull its configuration from the primary and come back as a member instead of a stranger.
I pulled the heartbeat links off the primary before I reset the troubled unit. That part I got right. You do not want a freshly wiped box announcing itself as a peer to a live primary and inventing a new argument about who is in charge.
I left the data ports connected.
The physical links out to the edge stack and the core stack stayed seated. Patch cables still in. Switch ports still up. I did not talk myself into that. I just never ran the implication. A factory-reset FortiGate does not sit there like a brick. It comes back as a stranger with every data port up. Nobody in the room caught it — not my team, not the Fortinet TAM who blessed the implementation plan, not the AI tool I bounced the plan against. We all signed off on a reset. We did not sign off on pulling the cables that would still be talking.
What a factory default actually does
A FortiGate factory reset does not put the device to sleep. It puts the device back to the day it left the warehouse.
On most of these platforms, the data ports stop being the interfaces you spent months naming and hanging policies on. They revert to members of a local hardware switch sitting in VLAN 1. Fresh box. Default VLAN. Ports up. Forwarding.
VLAN 1 is not a neutral number. On a lot of campus fabric it is still the native VLAN, or close enough that the distinction will not save you at 2 a.m. A new switch appearing on those links is not a quiet event. Spanning tree has to decide what this stranger is. BPDUs start moving. Ports that have been forwarding for years suddenly have an opinion about whether they should keep doing that.
I had just introduced a factory-default switch into a live layer-2 domain that was not expecting company.
The cascade was fast. And then the remote site — the whole office on the other end of those uplinks — went dark. Not the firewall pair. The office. Phones, badge readers, wireless, the circuit the users actually notice. Everything riding those stacks lost its path because I had reset a box without first taking its hands off the network.
I had to call one of my guys and ask him to drive up to that office in the middle of the night, power the secondary all the way down, and leave it down. Then I rebooted the primary. The primary came up clean. The path came back. The office breathed. The secondary sat there dark until I could treat it the way I should have treated it the first time — isolated, reset, rebuilt, and only then allowed to touch anything that mattered.
The heartbeat links were never the whole problem. The cables I left connected were.
Now translate
This is the part where I want you to sit with me for a minute. I did not write this to confess a change-control sin. I wrote it because I recognized the sin.
Most of the resets we attempt in the rest of life look like that secondary FortiGate. We want the clean config. We want to say we started over. And we will pull some of the cables — the obvious ones. The heartbeat links. The official connection to the old arrangement. The thing we can point to and say we dealt with it.
We leave the data ports seated.
The relationship that discipled us into the mess. The habit we told ourselves we could keep in a smaller dose. The app we deleted and then put back on the phone. The pastor we stopped sitting under but still let preach to us from the kitchen speaker. The church we left without actually leaving. The group chat that still gets the unconverted version of us, because those people knew us when, and it would be awkward to become a different man in front of them.
We factory-reset the confession and leave the topology in place. Then we are surprised when VLAN 1 shows up and takes the site down.
Scripture is not vague about this. Paul does not talk about a firmware update. He talks about a crucifixion.
Romans 6:6 says the old self was crucified with him so the body of sin might be brought to nothing. The old man is not paused. He is not left cabled into the production fabric on the theory that he will stay quiet while the new image loads. He is put to death. And even then — this is the part we skip — the putting-to-death is a present-tense discipline, not a memory of a night we walked an aisle.
Ephesians says the same thing from the other side of the rack: put off the old self, be renewed in your mind, put on the new self. Those are not moods. They are actions with a cost. You cannot put on the new self while the old interfaces are still members of the switch.
The cables have names
I am not going to pretend I know which cable you left connected. I know mine. You know yours.
Sometimes the cable is a person. Not every relationship that walked with you into the pit can walk with you out of it. The gospel does not give you a license to discard inconvenient people. It also does not require you to keep handing the old man a live interface. “Do not be deceived: ‘Bad company ruins good morals.’” That is a topology warning. Some links have to come out before the new config will hold.
Sometimes the cable is a habit you have baptized as personality. Temper. Appetite. The way you talk when you are tired. The way you look at a screen when nobody is in the room. You can pray about those things for a decade and still leave the port up. Hebrews does not tell you to manage the weight. It tells you to lay it aside — every weight, and sin which clings so closely. That is a cable that still has link light.
Sometimes the cable is a pulpit. I say that carefully, because I earn part of my living on one. A particular pastor. A particular church. A stream of teaching that once fed you and now only flatters the version of you that needs to stay sick. Leaving a church is not a sacrament. Hopping churches every time the sermon gets close is just another way to keep the old ports live. But staying in a room that will not tell you the truth is not faithfulness either. If the voice you are still patched into is the reason you cannot get clean, pull it.
Jesus was not delicate about this. If your eye causes you to sin, tear it out. He is not handing out surgery advice. He is telling you that a reset with the dangerous interface still up is not a reset. It is a delay.
The bound man and the trained one
I am reminded of an object lesson I heard in high school about how hard it is to follow Christ when you are still carrying years of habitual wrong and a long stack of bad decisions. The teacher asked us to imagine being challenged to play Michael Jordan.
In a fair game you would never touch the ball. That is the honest picture of the old man versus the new one if the old man is still fed, still loose, still on the court in his own shoes.
Then the lesson turned.
Suppose that for a month before the game, Jordan was bound hand and foot with duct tape. Locked in a dark room. Tied to a chair. Fed nothing but saltines and water. And in that same month you were coached by people who actually knew the game. You worked out every day. You ate like someone who intended to win. You were given real shoes.
It stands to reason you would win that game. You would be playing a man whose strength had been cut off at the source while yours had been built on purpose.
That is not a sports story. That is Romans 8 with a gym bag. The old man does not lose because you declared a new season. He loses when his supply lines are cut and the new man is actually trained.
Paul knew this in his body. He disciplined it and kept it under control, lest after preaching to others he himself be disqualified. He does not assume the sermon will do the work the training is supposed to do. He starves one man and feeds the other.
That is the part of repentance we keep trying to skip. We want the factory default without the isolation window. We want to play Jordan on Tuesday and still let the old man eat whatever he wants on Monday night.
You cannot. The ports that still have link will speak. They will speak in the default VLAN. They will take the site down.
Leave it dark until it is ready
Pulling the cable is rarely dramatic. That is why we keep missing it.
It looks like not going back to the room. Not opening the app. Not making the joke that used to get you in. Not keeping the number “just in case.” Not sitting under the voice that keeps giving the old man a job.
It also looks like the other half of the lesson — the training. The new man is not the absence of the old one. He has to be fed. Scripture that gets into the bloodstream. A church that will tell you the truth on a Tuesday. People who love you enough to notice when the old ports come back up. Prayer that is not a speech.
“Do not be conformed to this world, but be transformed by the renewal of your mind.” Renewal is not a mood. It is a mind trained until it can tell the difference. Paul again: put to death what is earthly in you. Not put on the watch list. Kill the process. Then put on what belongs to the new man. That is the running-config.
And when you fail — and you will, because the secondary does not always come up clean on the first try — you do not plug the old cables back in and call it honesty. You isolate again. You reset again. You let the primary do what the primary is for. “If anyone is in Christ, he is a new creation. The old has passed away; behold, the new has come.” That does not mean the closet is already clean. It means the old ports no longer have a rightful claim on the fabric.
The thing that saved that office was not cleverness. It was a man driving across town in the dark to shut a box all the way off, and a primary that could carry the load once the stranger was no longer talking.
Some of us have been running a factory-default soul on a live network for a long time. We pulled the heartbeat. We told the truth in a room. We even meant it. We just would not take the last cables out, because those cables still felt like home.
Pull them.
Leave the old box dark until the new config can hold. Train the man who has to walk back into the office in the morning. Starve the one who already knows the way back to VLAN 1.
There is grace enough for a real reset. There is not much grace left in a reset that keeps the dangerous interfaces up and then acts surprised when the site goes dark.
Unworthy, but His,
Nick
Scripture
“…put off your old self, which belongs to your former manner of life and is corrupt through deceitful desires, and to be renewed in the spirit of your minds, and to put on the new self, created after the likeness of God in true righteousness and holiness.” — Ephesians 4:22–24, ESV