When you build a Firewall in High Availability you need to be sure if the cluster's members are totally synchronized.

I am going to give you some commands in order to change the CLI session between the members for checking your HA.

First of all you need to watch how many members there are. If you have an active-pasive cluster, you need to know who is the master member. For this, you need to execute: # get system ha status


Then you need to know the vdoms and all configuration hashes. For this, you can execute: # get system checksum status
 

You need to compare the hashes between the members. It's a requirement to be the same. You change to another members executing:   
# execute ha manage 1


Finnaly you compare the hashes: # get system checksum status


If the hashes are the same, your cluster is ok, if not, you need to solve the problem because one or more the cluster's members are misconfigured.