Skip to main content
DongHwan1
DongHwan1
Explorer
April 28, 2025
Solved

Automatic Updates for FortiManager Integrated with FortiGate question.

  • April 28, 2025
  • 3 replies
  • 5252 views

Hello,

I would like to inquire about the automatic update management for FortiManager that is integrated with FortiGate and the Security Fabric.
Could you please provide information on how automatic updates are handled in this setup?


As far as I know, when a FortiGate is connected to a FortiManager, the FortiGate shows that automatic updates are enabled, and because it is managed by the FortiManager, the option to disable automatic updates is not available on the FortiGate.

So, does this mean that automatic updates are not actually performed on FortiGates that are managed by FortiManager?


I would like to perform updates manually when I want, and I do not want automatic updates to be applied.

Is there anything that needs to be configured separately on the FortiManager side?

 

Thaks all.

Best answer by sw2090

hm we are using FMG with several FGT for years now. 

As far as firmware upgrades are concerned: our FMG never automatically updated any FGT. It probably would if you set up a firmware template that tells it to do so. It can do scheduled upgrade on demand though if you create a template for that and add some fgt to the template that have a valid firmware upgrade license.

 

Config updates per default are only pushed from FGT to FMG (only device config) automatically (AutoUpdate). You can configure what should be pushed automatically in the adom settings in fmg.

 

3 replies

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
April 28, 2025

Not sure if you want to do in the same way we do for those FMG managed FGT's upgrade. But those three commands in my post below are basically what we put in those FGTs.
https://community.fortinet.com/t5/Support-Forum/Stop-auto-firmware-upgrade-via-FMG/td-p/370165
Although no one in this community confirmed or denied my post, so far it seems to be working as intended.

Toshi

    DongHwan1
    DongHwan1Author
    Explorer
    April 29, 2025

    Thank you for clarifying! 

    Before I start writing, I read your post. I followed your instructions for the setup, and it seems to be working as intended. Thank you.
    However, with this setup, it seems impossible to push updates from FortiManager to the gate. I think it might be better if partial support is provided so that updates can be made from the manager to the gate. Thank you for your response!

    kaman
    Staff
    kaman
    Staff
    April 28, 2025

    Hi DongHwan1,

    Check the config system central-management settings.

    How to disable management tunnel to FortiGate Cloud

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-management-tunnel-to-FortiGate/ta-p/348924


    Disabling the management tunnel can be done through the CLI:


    Note this configuration also disables central management by FortiManager.


    config system central-management
    set type none
    end


    Disabling Firmware Upgrades through FortiManager.


    To disable automatic firmware upgrades on FortiGate devices managed by FortiManager, perform the following steps:


    config system central-management
    set allow-push-firmware disable
    set allow-remote-firmware-upgrade disable
    end


    Please refer to the document below for more information:

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-automatic-firmware-upgrades-on/ta-p/326998#:~:text=From%20the%20GUI%20it%20can,%2D%3E%20Disable%20automatic%20patch%20upgrades.


    If you have found a solution, please like and accept it to make it easily accessible to others.


    Regards,
    Aman

      DongHwan1
      DongHwan1Author
      Explorer
      April 29, 2025

      It's a bit disappointing that the central management feature of FortiManager is also disabled. There may be situations where updates need to be made from the manager, but in any case, I think I should keep using this option.

      Thank you for your response!

      sw2090
      SuperUser
      sw2090Answer
      SuperUser
      April 29, 2025

      hm we are using FMG with several FGT for years now. 

      As far as firmware upgrades are concerned: our FMG never automatically updated any FGT. It probably would if you set up a firmware template that tells it to do so. It can do scheduled upgrade on demand though if you create a template for that and add some fgt to the template that have a valid firmware upgrade license.

       

      Config updates per default are only pushed from FGT to FMG (only device config) automatically (AutoUpdate). You can configure what should be pushed automatically in the adom settings in fmg.

       

        Terms & ConditionsCookie settingsAccessibility statement