Troubleshooting Tip: No valid upgrade path error when upgrading the FortiGate firmware

In affected firmware versions and platforms, the upgrade path matrix cannot be downloaded as it is too large for the assigned buffer. This causes supported upgrades to incorrectly show no valid upgrade path.

Example upgrading FortiOS from v7.4.8 or v7.4.9 to FortiOS v7.4.10 or 7.4.11:

Attempting to upgrade a VM and hardware from FortiOS v7.4.8 or v7.4.9 to v7.4.10 or v7.4.11 shows the following error in the GUI: 'No valid upgrade path from FortiOS v7.4.9 build2829 to FortiOS v7.4.11 build2878'.

However, the upgrade path from v7.4.9 to v7.4.11 is supported for this platform. The same applies to upgrading from v7.6.4 to 7.6.5 or v7.6.6.

Diagnostics:

The image list shows that firmware images for v7.4.9 and v7.6.5 are available for upgrade.

diagnose fdsm image-list | grep v7.4
07004000FIMG0013704011 v7.4 MR4-GA-M P11 b2878 (upgrade)
07004000FIMG0013704010 v7.4 MR4-GA-M P10 b2867 (upgrade)
07004000FIMG0013704008 v7.4 MR4-GA-M P8 b2795 (downgrade)
07004000FIMG0013704007 v7.4 MR4-GA-M P7 b2731 (downgrade)
07004000FIMG0013704006 v7.4 MR4-GA-M P6 b2726 (downgrade)
...

diagnose fdsm image-list | grep v7.6
07006000FIMG0026806005 v7.6 MR6-GA-M P5 b3651 (upgrade)
07006000FIMG0026806004 v7.6 MR6-GA-F P4 b3596 (upgrade)
07006000FIMG0026806003 v7.6 MR6-GA-F P3 b3510 (upgrade)
07006000FIMG0026806002 v7.6 MR6-GA-F P2 b3462 (upgrade)
07006000FIMG0026806001 v7.6 MR6-GA-F P1 b3457 (upgrade)
07006000FIMG0026806000 v7.6 MR6-GA-F b3401 (upgrade)

...

However, the image-upgrade-matrix showing supported upgrade paths is blank.

diagnose fdsm image-upgrade-matrix
Result=Error.

Resolution:
The issue has been acknowledged and is resolved in FortiOS versions 7.4.10 and 7.6.5, and is also scheduled for v8.0.0 build 0097.

Once upgraded to one of these versions, the FortiGate will be able to download the image upgrade matrix, and the false-positive upgrade path warning will no longer occur.

This issue only affects platforms with a large number of historical firmware versions (i.e., FortiGate VMs).

Workaround:  

The workaround is to upgrade the FortiGate-VM using the CLI command 'execute restore image management-station <image_id>'. To do this, follow the steps below:

1. Verify the upgrade path manually using the Upgrade Path Tool Table or the support site, see the article Technical Tip: How to verify FortiGate Upgrade path to upgrade the FortiGate to a higher Firmware Version.
   
   
2. Upgrade each step in the upgrade path manually using one of the following methods:
   
   • Manual image upload from the GUI, following this KB article: Technical Tip: Manual firmware upgrade by referring to an upgrade path.
   • Manual image upload from CLI using TFTP/FTP/management station: Technical Tip: Restore image using an FTP server and from an URL and Technical Tip: Firmware Upgrade/Downgrade via Built-in FortiGate Management Station.

Example upgrading FortiOS v7.4.9 to v7.4.11 using management-station:

diagnose fdsm image-list | grep v7.4
07004000FIMG0013704011 v7.4 MR4-GA-M P11 b2878 (upgrade)
07004000FIMG0013704010 v7.4 MR4-GA-M P10 b2867 (upgrade)
07004000FIMG0013704008 v7.4 MR4-GA-M P8 b2795 (downgrade)
07004000FIMG0013704007 v7.4 MR4-GA-M P7 b2731 (downgrade)
07004000FIMG0013704006 v7.4 MR4-GA-M P6 b2726 (downgrade)

...

execute restore image management-station 07004000FIMG0013704011

####################################################################################################
This operation will replace the current firmware version!
Do you want to continue? (y/n)y

Verifying the signature of the firmware image.
Image verification OK!
Warning: Installing image v7.4.11 from v7.4.9 may result in loss of configuration. Do you want to proceed?
Do you want to continue? (y/n)y

Warning: Upgrading to an image with Mature maturity notation.

For v7.6.5 to v7.6.6:

diagnose fdsm image-list | grep v7.6
07006000FIMG0013706006 v7.6 MR6-GA-M P6 b3652 (upgrade)
07006000FIMG0013706005 v7.6 MR6-GA-M P5 b3651 (upgrade)
07006000FIMG0013706004 v7.6 MR6-GA-F P4 b3596 (upgrade)
07006000FIMG0013706003 v7.6 MR6-GA-F P3 b3510 (upgrade)

...

execute restore image management-station 07006000FIMG0013706006
Please wait...

Getting image 07006000FIMG0026806005 from Management station...
####################################################################################################
This operation will replace the current firmware version!

Do you want to continue? (y/n)y

Verifying the signature of the firmware image.
Warning: Installing image v7.6.5 from v7.4.9 may result in loss of configuration. Do you want to proceed?
Do you want to continue? (y/n)y

Warning: Upgrading to an image with Mature maturity notation.

Please wait for system to restart.

Note: The firmware upgrade is applicable for the HA environment as well, and the HA upgrade will follow the usual flow, i.e., the image will be pushed to the secondary for upgrading first and then the primary.

Example:

This can also be done for v7.6.6:

Note: This firmware upgrade issue also affects physical appliances, not only FortiGate VM.

Alternative method for firmware upgrade (workaround):

1. Downgrade the device to FortiOS v7.2.x release (for example, v7.2.12).
2. After the downgrade is complete, perform a direct upgrade to either v7.4.10 or v7.6.5.

This upgrade path has been validated to complete successfully without further issues (refer to the screenshots below).

If the alternative method (workaround) fails, the only option is to upgrade by manually downloading the firmware image:

Firmware images for all FortiGate units are available on the Fortinet Customer Service & Support website.

To download firmware:

1. Log in to the support site with user name and password.

2. Go to Support -> Firmware Download. A list of Release Notes is shown. Download and review the Release Notes for the firmware version being used to upgrade the FortiGate unit.

Note: Select FortiGate under Select Product as shown below: 

3. Select the Download tab.

4. Navigate to the folder for the firmware version being upgraded to.

5. Find the device model on the list. FortiWiFi devices have file names that start with FWF.

6. Select HTTPS in the far right column to download the firmware image.

Next, proceed to the manual upgrade: Technical Tip: How to manually perform a firmware upgrade from the GUI.

Note: If the output of the following command does not work: 

execute restore image management-station 

Use console access (a console cable is required).

Related articles:

• Troubleshooting Tip: No valid upgrade path from FortiOS v7.0.17
• Troubleshooting Tip: A valid upgrade path cannot be determined for manually uploaded firmware