Fortigate HA upgrade

Yea you need to break the HA and upgrade the passive unit. Once updated, attach the ha cable first and wait for the units to come in sync and then attach the network cables

You don't have to disconnect HA heartbeat cable(s). Just need to shutdown(set status down) the interface(s) on the primary side. Then need to be unshut when it's upgraded and ready for config sync.

But I would be more careful about those in/out (wan/lan) cables/connections that need to be connected to switch(es), not to impact live traffic while booting up and upgrading the secondary. Shut down those ports from/to the secondary on the switch side until its upgraded and synced with the primary.

Also I would factory-reset the secondary before upgrading it.

Toshi

Do I need to break HA and upgrade 2nd chassis separately before connecting in HA again?

>> this is the best approach, but not always easy. As Toshi mentioned, there are other ways.

Or it will be get updated automatically if i power on? >> No

You can just try the upgrade once again directly,

or save the config, failover, and start the upgrade from the other unit (yes, units will reboot).

I think i will downgrade the active unit to same version on which down unit currently is and then power on passive unit. 

Then upgrade it in HA. Hopefully that will be more easy approach.