Explorer

Question

OS upgrade Issue

13 replies
160 views

We currently have a FortiGate firewall running FortiOS version 7.2.11, and we are planning to upgrade the firmware to a recommended and supported version.

Could you please share the recommended FortiOS version for our firewall model, along with the correct and supported upgrade path from FortiOS 7.2.11?

FortiGate

funkylicious

SuperUser

as for the upgrade path, select your model , target fortios and it will be displayed

https://docs.fortinet.com/upgrade-tool/fortigate?model=FF181F&from=6.4.11&to=6.4.12

"jack of all trades, master of none"

adeelghaffar766Author

Explorer

Bundle of thanks Dear

osoleimani

Staff

Hi,

The approach mentioned above is correct. One additional point is that the recommended FortiOS release and the upgrade path serve two different purposes.

The Recommended Release guidance can be used to identify the generally recommended FortiOS release for a given FortiGate model, while the Upgrade Path Tool should be used to determine the actual supported sequence from the current version to the target version.

Since the FortiGate is currently running FortiOS 7.2.11, the exact upgrade path should be checked against the specific FortiGate model before proceeding.

One additional detail to consider is whether the FortiGate is operating as a standalone unit or as part of an HA cluster, as the upgrade procedure can differ between these deployment scenarios.

The recommended release guidance is reviewed and updated quarterly, so it is also worth checking the current version of the article when planning the upgrade.

I would also recommend reviewing the release notes for each version in the resulting path and taking a configuration backup before starting the upgrade.

By checking the recommended release for your specific model, using the Upgrade Path Tool from FortiOS 7.2.11 to the selected target, and confirming whether the unit is standalone or part of an HA cluster, you can plan the upgrade using Fortinet's supported guidance.

Hope this helps with your upgrade planning.

adeelghaffar766Author

Explorer

Please confirm one thing if firewall have HA then please share the procedure of OS upgrade thanks

osoleimani

Staff

Hi adeelghaffar766,

Yes. If the FortiGate is operating as an HA cluster, the firmware upgrade is performed from the cluster rather than upgrading each unit individually.

For a standard FortiGate HA cluster, FortiOS supports an uninterrupted upgrade process. During the upgrade, the subordinate units are upgraded first, a new primary is selected from the upgraded units, and the former primary is then upgraded before the cluster completes the primary-unit selection process.

Before starting the upgrade, I recommend:

Back up the configuration.
Confirm that the HA cluster is healthy and synchronized.
Use the Upgrade Path Tool to determine the supported path from FortiOS 7.2.11 to the selected target version.
Review the release notes for each upgrade step.
Schedule an appropriate maintenance window.

If, for any reason, the normal HA upgrade does not complete as expected, a manual HA upgrade procedure can be used as a fallback:

Separate the HA members using the appropriate isolation procedure to avoid a split-brain condition.
Upgrade the secondary/backup unit first to the selected target FortiOS version and verify that it is operating correctly.
Upgrade the primary/master unit to the same target FortiOS version.
Reconnect the HA members and allow them to synchronize.
Verify that both units are running the same FortiOS version and that the HA cluster is healthy and synchronized.

For the manual procedure, I would not recommend simply disconnecting the HA heartbeat interfaces, as this can result in both units considering themselves primary and creating a split-brain condition.

The same process should be followed for each hop in the supported upgrade path, rather than treating the upgrade as a single jump.

In short, the normal HA upgrade process is designed to coordinate the upgrade across the cluster, while the manual procedure provides a controlled fallback when the normal process does not complete as expected.

Hope this helps clarify the HA upgrade procedure.

adeelghaffar766Author

Explorer

And confirm one best who is the best option the OS download on local PC or upgrade the OS direct from the internet from firewall

sjoshi

Staff

I would recommend to download the OS on the PC and check the md5 checksum

Thanks, Salon

adeelghaffar766Author

Explorer

Thanks to all for update

Confirmation Regarding FortiGate HA Firmware Upgrade

Since the firewalls are configured in HA and are fully synchronized, when we initiate the FortiOS upgrade, will the OS/firmware upgrade automatically be performed on both firewall units through the HA upgrade process?

adeelghaffar766Author

Explorer

Confirmation Regarding FortiGate HA Firmware Upgrade

Since the firewalls are configured in HA and are fully synchronized, when we initiate the FortiOS upgrade, will the OS/firmware upgrade automatically be performed on both firewall units through the HA upgrade process?