Skip to main content
Tannu1986
Tannu1986
Explorer II
October 16, 2025
Solved

FortiGate 101F Upgrade – From FortiOS 7.0.8 to 7.x with BGP Enabled

  • October 16, 2025
  • 1 reply
  • 1453 views

Hi everyone,

I’m planning to upgrade a FortiGate 101F currently running FortiOS 7.0.8 to a newer 7.x version (likely 7.2 or 7.4).

My client is a bit concerned about the BGP stability after the upgrade, since the FortiGate is currently handling BGP routing.

Before proceeding, I’d like to ask if anyone has already performed this specific upgrade and could share their experience;

  • Any issues encountered with BGP sessions, neighbors, or route redistribution after the upgrade.

  • Whether you recommend going straight to 7.4.x or stopping at 7.2.x for now.

Any insights, tips, or best practices would be greatly appreciated

Thanks in advance for sharing your experience!

Best answer by Toshi_Esumi

BGP is a mature protocol since last century and FGT's coverage is quite mature as well (not about the firmware version with 'M'), which at least we've been using from 4.0 MR3 for last 13-14 years) without any major issue. We might have encountered  some memory issues. But if that's true that would have been very early version like x.x.1-x.x.5 in the major versions. But that won't happen until it keeps running for some time without any issues.
Your customer sounds like worrying that BGP is fragile, it's working by chance. If that's the case, it wouldn't come up even a single power-cycle. If that's the concern, you can offer them reboot it multiple times to confirm it comes up as it was before. 

But the most important point is, keeping running an old firmware is risking their network/org having serious security vulnerabilities. If they need to comply with any security standards, or audits, they would be forced to upgrade it to the latest enough version regardless any other minor issues. You should point that out to them.

Then always keep the original version of firmware image handy as well as the last config backup with the version. Then in the worst case, you can always roll it back to the previous version with a few available methods, which should be in your change control document as a contingency plan, and you can provide it to the customer if necessary. 

 

Toshi

1 reply

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
October 16, 2025

What is your customer's specific concerns about BGP after upgrade?
We don't use much 100/101F but have some with BGP(eBGP) and those went from 7.0.11 or 12 to 7.2.9 or .10 about a year ago. But other models have more BGP and went through the same upgrade paths about the same time. But the main difference in software between models are due to the difference between those ASICs, including NPU. And, routing protocol like BGP is, I believe, handled by CPU (not NPU). So models don't matter.
I don't remember when last time we encounter any BGP related bug for long time, or problem after upgrades, probably because we don't use any tricky BGP features, like ADVPN, etc. But the versions wouldn't make much deference unless FTNT added a new BGP related feature which was not in previous version didn't have. But obviously you wouldn't be using those new features now. We're about to upgrading all of those FGTs to the latest 7.4.x (currently 7.4.9). But BGP would be the last thing to concern.
But if your customer is concerning about issues comes with the upgrade process, which requires a reboot, that's nothing different from a just power-cycling the current FGT.


Toshi 

    Tannu1986
    Tannu1986Author
    Explorer II
    October 16, 2025

    The client’s main concern is that the BGP might stop working and fail to restart after the update, considering that their firewall is running an older firmware version , which is quite dated.So,Perfect, thank you. I’ll try to convince my client to proceed with the update by explaining that there won’t be any difficulties in carrying out the process.

    Toshi_Esumi
    SuperUser
    Toshi_EsumiAnswer
    SuperUser
    October 16, 2025

    BGP is a mature protocol since last century and FGT's coverage is quite mature as well (not about the firmware version with 'M'), which at least we've been using from 4.0 MR3 for last 13-14 years) without any major issue. We might have encountered  some memory issues. But if that's true that would have been very early version like x.x.1-x.x.5 in the major versions. But that won't happen until it keeps running for some time without any issues.
    Your customer sounds like worrying that BGP is fragile, it's working by chance. If that's the case, it wouldn't come up even a single power-cycle. If that's the concern, you can offer them reboot it multiple times to confirm it comes up as it was before. 

    But the most important point is, keeping running an old firmware is risking their network/org having serious security vulnerabilities. If they need to comply with any security standards, or audits, they would be forced to upgrade it to the latest enough version regardless any other minor issues. You should point that out to them.

    Then always keep the original version of firmware image handy as well as the last config backup with the version. Then in the worst case, you can always roll it back to the previous version with a few available methods, which should be in your change control document as a contingency plan, and you can provide it to the customer if necessary. 

     

    Toshi

      Terms & ConditionsAccessibility statement