Technical Tip: Offline Upgrade of FortiClient EMS from v7.4.1 to v7.4.3 (Air-Gapped Environment)

Prerequisites:

Before proceeding with the upgrade:

• Ensure a full backup of the EMS configuration and database is available.
• Ensure sufficient disk space is available, particularly in the following locations:

/opt/forticlientems/

/var

• Ensure the correct .bin upgrade file is downloaded (e.g., forticlientems_7.4.3.XXXX.bin).

By default, the EMS upgrade process can try to reach Fortinet services to repack or refresh client installers. In air-gapped environments, this might cause delays, timeouts, or failures.

Installation Instructions (Offline Upgrade):

• Copy the .bin upgrade file onto the EMS server.
• Shutdown EMS services by using the following command (optional but advisable to cleanly upgrade):

sudo systemctl stop fcems

• Run the installer with the following command:

sudo./forticlientems_7.4.3.XXXX.bin -- --allowed_hosts '*' --enable_remote_https=0

--allowed_hosts '*': Needed if there is no intention to limit EMS access to certain IPs.

--enable_remote_https=0: Disables internet calls.

If --enable_remote_https=0 does not exist, remove the option altogether. The installer will stay offline as long as:

• The .bin file is downloaded locally.
• No --enable_remote_https is used explicitly.

Even without terminating EMS services, the upgrade may still work, although it is recommended to terminate them.

Wait for the upgrade process to finish. It will take time, but it should not fail if the steps above are adhered to and the requirements are fulfilled.