Staff

Technical Tip: FortiAuthenticator HA cluster firmware upgrade

Description

This article describes the basic process for the firmware upgrade of a FortiAuthenticator Cluster.

Scope

FortiAuthenticator cluster (3.1, 6.0.0, and above).

Solution

Requirements:

In a FortiAuthenticator cluster, there is an internal network that is configured to communicate with cluster members. It is called the HA management network. The default is 192.168.15.x/24 network. A PC is required in the same network which has the FortiAuthenticator firmware image that we need to upgrade to.
HTTPS access is required to the management IPs on each of the cluster members. It should be done after hours as there will be a downtime, due to the reboot. Make sure to document test cases before the upgrade (or any change).
For example, machine authentication, wireless authentication, guest user portal, RADIUS authentication, FTM push etc.
Document these and how they are working.
After the upgrade - test the same cases again and see if a test case is not working (compare that before the upgrade was working).

The upgrade of the cluster comes in 2 modes:

The upgrade process seen here is for the Active passive setup as they share the same internal network.

The upgrade procedure for coordinated upgrade:

Initiate the firmware upgrade from the active member rest of the process is coordinated and synchronized, and the sequence is below.
The firmware image is transferred to a standby member.
The firmware is upgraded on the standby member.
The standby member is rebooted and synchronized with the active member.
The standby member is the new active device, and firmware is upgraded on the former active device.
Former active member reboots and synchronizes with new active device.
Former active member becomes the active device and former standby devices become the standby device.

For the FortiAuthenticator cluster (3.1,6.0.0 and above) individually.

It is recommended that no administrative or configuration changes are made between these upgrades. Because of this, expect a short downtime.
Upgrade the secondary unit first from the management interface, and wait until it comes back up.
When the secondary unit comes back up, both units will become standalone masters because of a firmware version mismatch. This will mean that logins from the public interface may fail at this time.
At this point, upgrade the primary unit from the management interface.
After the upgrade, the cluster will be formed again and FortiAuthenticator will be in HA mode.

Upgrades to the Active: Active or LB mode are to be done individually on each member node.