Troubleshooting Tip: IPS engine manual update failing with error 'Failed to upgrade database'

Description

This article describes how to resolve a scenario where the manual upgrade of the IPS engine fails with the error 'Failed to upgrade database'.

Scope

FortiGate, BIOS security level set to High (Level 2).

Solution

If the BIOS security level is set to 'High', the firewall will reject the manually uploaded unsigned engine and give the following error:

Verify the BIOS security level using the 'get system status' command on the CLI:

# get system status
Version: FortiGate-200F v7.6.7,build3704,260601 (GA.M)
First GA patch build date: 240724
Security Level: High 

First, change the firewall security level to 'Low' (Level 1) before upgrading the IPS Engine.
 

To change the security level:

1. Connect to the console port of the FortiGate.

2. Reboot the FortiGate (execute reboot) and enter the BIOS menu.

3. Press [I] to enter the System Information menu.

4. Press [U] to enter the Set security level menu.

5. Enter the required security level.

6. Continue to boot the device.

Note:

Some FortiGate models do not provide the U option in the BIOS and use a physical security switch instead. Check the hardware-specific documentation before changing the security level.

Refer to this document: Enhance BIOS-level signature and file integrity checking for more information about BIOS-level signatures and file integrity.

This error can also occur if the IPS engine version is a special build provided by the developers; in this case, enable 'autoupdate downgrade' using the command below:

diagnose autoupdate downgrade enable 

After executing the command, upload the required IPS engine file, and once the IPS upgrade has completed successfully, revert the setting to its default state by running the command:

diagnose autoupdate downgrade disable

Additional Information:

In some environments, downtime for rebooting the device to lower the security level is not acceptable. In such cases, if the firewall is managed by FortiManager, the device administrator can import the required IPS engine package into FortiManager and install it directly.
This allows the IPS engine to be upgraded without reducing the security level or rebooting the firewall.

For the FortiOS v7.6 and v8.0 branches, before attempting to downgrade the BIOS version, first disable GUI CDN Usage and admin-http-rate-limit under the global settings, then retry the IPS engine upgrade. Disabling GUI CDN Usage will automatically log out the administrator from the existing session. This does not impact data traffic or production traffic.

config system global
set admin-http-rate-limit-max-requests 0
set gui-cdn-usage disable
end

Note:
From version v7.0.16, v7.2.11, v7.4.6, and v7.6.1, the BIOS security level has been updated from numeric classification 0/1/2 to Low/High. For more information, refer to this document BIOS security Low and High level classification.

Related document:

Technical Tip: Change security level on FortiGate G series models