Skip to main content
Hieuvm
Explorer II
April 15, 2024
Question

How to keep the connections when perform firmware update? 2 Fortinet 100e firewall with HA

  • April 15, 2024
  • 3 replies
  • 3952 views

We have 2 Application servers that have some applications connect locally to pg-pool on the same server. 2 Postgresql Databases servers, stacking switch between AP servers to firewall and stacking switch between firewall to DB servers. When we updated the firewall firmware, we have about 1 minute downtime for fail-over process between the firewall devices. After that, the pg-pool connection to database server disconnected once and re-connected after that. But the application still timeout and disconnect. I would like to know if there is a way to update firewall firmware on 1 firewall without network disconnection? Thank you!

3 replies

srajeswaran
Staff
Staff
April 15, 2024

With "uninterruptible-upgrade enable", there is no traffic drop expected. Are you saying, you are getting 1min downtime even with this setting?


https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-HA-upgrade-procedure-and-the-status/ta-p/246692

Hieuvm
HieuvmAuthor
Explorer II
April 15, 2024

I will check it now. Thank you for the suggestion!

Hieuvm
HieuvmAuthor
Explorer II
April 15, 2024

I have uninterruptible-update enabled already. Still have about 1mins downtime. Can you give me direction for what else to check then Mr.Suraj. Thank you!

AEK
SuperUser
SuperUser
April 15, 2024

make sure you enabled session pick-up.

config system ha
    set session-pickup enable
end
AEK
Hieuvm
HieuvmAuthor
Explorer II
April 16, 2024

Currently I don't have session-pickup enable yet. I will check it now. Thank you.

smaruvala
Staff
Staff
April 15, 2024
Hieuvm
HieuvmAuthor
Explorer II
April 16, 2024

It hasn't been enabled yet. I will check it and let you know. Thank you!

 

Toshi_Esumi
SuperUser
SuperUser
April 16, 2024

If not enabled, the down period should start at the point b) in my previous comment. Then go down again (if came back up once) at the point c).

Toshi