Staff

Troubleshooting Tip: 'Image upgrade failed. Firmware image is not valid - FortiGate HA firmware upgrade failed due to firmware version mismatch'

Forum|Forum|3 years ago
November 11, 2022
0 replies
29547 views

Description

This article describes how to fix the error 'Image upgrade failed. Firmware image is not valid. FortiGate HA firmware upgrade failed.'

In this case, the Primary and Secondary FortiGates have mismatching firmware versions.

Using this method will result in total downtime for the entire network as both FortiGates will be rebooted.

This method also assumes that the HA Management Interface is configured so that the GUI of the FortiGate with the lower firmware version can be accessed.

This method will cause a total service outage of both firewalls. Read all the steps first before proceeding to execute them.

Scope

FortiGate HA. Applicable for Active-Passive and Active-Active.

Solution

FortiGate HA will be out of sync when the firmware versions on the Primary and Secondary FortiGates do not match.
Download the firmware version to be upgraded from the Fortinet Support Portal: Support.
Perform an HA failover so that the FortiGate on the lower firmware version is the Primary.
See this article: Technical Tip: How to use failover flag to change Active unit.
In the meantime, access the FortiGate using the higher firmware version.

Note:

If there is no management IP configured for access, SSH into the FortiGate on the higher firmware version through the current Primary.

SSH into the current Primary.
Run this command:

execute ha manage ?

An ID will be seen here.
Run the following:

execute ha manage <id> <username>

Enter the ID and the Username of the administrator used to log into FortiGate. Press Enter, type the password in, and then press Enter again. See Technical Tip: Managing individual cluster units with the CLI command 'execute ha manage'.

Access the GUI of the FortiGate with the lower firmware version.
Perform the firmware upgrade by uploading the firmware version manually.

Below version 7.2.x:

Go to System -> Firmware -> Browse and Upload the firmware image.

Version 7.2.x onwards:

Go to System -> Fabric Management -> Select the FortiGate and select Upgrade -> File Upload -> Browse and Upload the firmware image.

Version 7.4.x onwards:

Go to System -> Firmware and Registration -> Select the FortiGate and select Upgrade -> File Upload -> Browse and Upload the firmware image.

When the Upload progress of the firmware hits 50% or 70%, reboot the other FortiGate that is already on the higher firmware version via SSH.

To reboot the firewall via SSH CLI, run this command:

execute reboot

Wait for both FortiGates to become active. Both FortiGates should now be on the same firmware version. Wait a few minutes for HA to sync.

An alternative option is to change the 'Security level' to '0' on the Primary and Secondary FortiGates and perform the upgrade again. However, this method requires console access.

To change the security level: BIOS-level signature and file integrity checking during downgrade.

It is recommended to set the Security level back to '2' after the upgrade.