Skip to main content
kjs-admin
kjs-admin
New Member
December 2, 2025
Question

On a fortigate 100F how can I update the secondary partition to match the version on the primary?

  • December 2, 2025
  • 4 replies
  • 1276 views

I am preparing to update our Fortigate 100F and when I run the command >diagnose sys flash list<enter> I see that there are 2 partitions with different versions.

 

It is my understanding that when an upgrade is initiated the secondary partition will get the upgrade and become the new primary partiton after the upgrade.  My question is:

 

How can I update the now ... secondary partition ...  so that both partitions have the same version?

 

Can someone explain to me how the upgrade process works?  If I have to update a couple of versions to get to the desired version and the upgrade always goes to the alternate partition which had the older version.. how does that work?  Or does the version upgrade always upgrade the primary partition?


My concern is what if the primary partition is no longer bootable and the Fortigate reverts to the secondary partition and t is at a earlier version?  I would prefer to upgrade the fortigate then after 3 months upgrade the other partition.   I was able to do this other non-fortigate appliances.

4 replies

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
December 2, 2025

Your understanding is correct. Any FGT upgrade/downgrade always installs the new/old firmware image into the alternative pertition (if partition 1 is active, installs into 2. If 2, into 1).
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-FortiGate-handle-backup-image-when-upgrade/ta-p/328674
So if you upgrade a FGT from like 7.4.1->7.4.2->7.4.3 it goes like:
  Partition1:7.4.1 - Active/Partition2:7.2.x -> P1:7.4.1/P2:7.4.2 - Active -> P1:7.4.3 - Active/P2:7.4.2.

If you want/need to keep the original 7.4.1 image&config after finished upgrading it to 7.4.3, you need to swap the active partition back to Partition1: 
  exe set-next-reboot primary -> exe reboot
before the 2nd step of the upgrades to 7.4.3, so that the final result would be like
  Partition1:7.4.1/Partition2:7.4.3 - Active

My understanding is that even when the current active partition fails to boot up for whatever the reason is, the FGT wouldn't automatically change the active partition to the alternative one to come up with the old image&configuration. If that happens and got stuck, only way to recover is getting in the boot menu and upload the image from a TFTP server into the broken partition after reformatting it. After booting it up, you have to upload a backup config with that version. Or, at that time, the CLI is operational and you can change the active boot partition to boot up with the old image&config.

Toshi

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    December 2, 2025

    Probably (I hope) "exe reboot" is not necessary after changing the Active partition. Othewise, the subsequent upgrade would use the original (old) config to convert it to the new version, which might not be supported.

    Toshi

    yderek
    Staff
    yderek
    Staff
    December 2, 2025

    From what I can see, the command dia sys flash list, is listing out the current firmware and second partition you seeing is the backup firmware which is the version you upgrade from previously , below KB can help you understanding this better 

     

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-FortiGate-handle-backup-image-when-upgrade/ta-p/328674

     

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Selecting-an-alternate-firmware-for-the-next/ta-p/191425

     

     

      kjs-admin
      kjs-adminAuthor
      New Member
      December 2, 2025

      If the alternate partition is at least 2 previous version behind .... how can that partition upgrade directly to the new version?  If we need to upgrade  from 7.2.8 to 7.2.10 to 7.4.5  If you flip flop partitions for upgrades how can those partitions upgrade directly?

      If those alternate partitions successfully get upgraded then why not just upgrade directly to the desired destination version.  Does the partitions get formatted and then re-installed with the new version?


      Toshi_Esumi
      SuperUser
      Toshi_Esumi
      SuperUser
      December 2, 2025

      My assumption has been the upgrade process converts the RAM loaded config/config file to the new firmware version's, not from the config file from the flash memory/partition. So as long as you're running the intermediate version, it can be upgraded to the next version, then save it to the flash/partition after that.

      Toshi

        kjs-admin
        kjs-adminAuthor
        New Member
        December 3, 2025

        Hello Toshi_Esumi, 

        What do you mean by the intermediate version?  What if the version on the alternate partition is very old will the upgrade to the new version fail?

         

        kjs-admin
        kjs-adminAuthor
        New Member
        December 5, 2025

        OK,

        My question is if you have...

         

        partition1: 7.4.8 - Active (and running with this version currently)
           partition2: 5.6.2 (alternative) 

        can you update directly on the alternative partition from 5.6.2 to 7.4.9?  Usually you would need accomplish that in a couple of software upgrades.

         

        Terms & ConditionsAccessibility statement