FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
samandeep
Staff
Staff
Article Id 306899
Description

This article describes that Auto-firmware-update is enabled by default when upgrading FortiOS from v7.0.x to v7.2.6 and how to disable it.

 

This issue is resolved in v7.2.9.

Scope FortiGate v7.2.5, v7.2.6, v7.4.4, v7.4.8 and v7.6.3.
Solution

In some models, when units are upgraded from v7.0.x series to v7.2.5 or v7.2.6, this auto-firmware feature just gets enabled.

 

Note:

From v7.4.5 and higher, the 'automatic firmware upgrade option has changed'.

 

The command 'auto-firmware-upgrade' is enabled for all the models, also including the VMs: Changes in default behavior  

 

However, when deploying fresh v7.2.6 and v7.4.4 on FortiGates, the auto-firmware feature will be disabled by default.

 

If upgrading from v7.0.x series to v7.2.8 or later via v7.2.5/7.2.6 based on the FortiOS upgrade path. Based on the requirement, it is possible to disable this feature.

 

To check whether this feature is enabled or not, check the following command:

 

diagnose test application forticldd 13

 

If enabled, the CLI response would be:

 

Automatic image upgrade: enabled

 

If disabled, the CLI response would be:

 

diagnose test application forticldd 13

Scheduled push image upgrade: no

Scheduled Config Restore: no

Scheduled Script Restore: no

Automatic image upgrade: Disabled.

 

To preview the setting in the CLI, run:

 

config sys fortiguard
show full | grep auto

  

The output should show in the CLI as follows:

 

FortiGate # config sys fortiguard

FortiGate(fortiguard) # show full | grep auto
    set auto-join-forticloud enable
    set auto-firmware-upgrade enabled   <-----
    set gui-prompt-auto-upgrade disable
    set interface-select-method auto

 

To edit the auto-upgrade-firmware setting, it is possible to disable the feature and view the change from the CLI with the following:

 

config sys fortiguard
    set auto-firmware-upgrade disable
end

config sys fortiguard
show full | grep auto


The output should show in the CLI as follows: 

 

FortiGate # config sys fortiguard

FortiGate(fortiguard) # show full | grep auto
    set auto-join-forticloud enable
    set auto-firmware-upgrade disable   <-----
    set gui-prompt-auto-upgrade disable
    set interface-select-method auto

 

The auto-firmware-upgrade feature has started on firmware version 7.2.1 and higher. 

 

In certain scenarios, upgrading from the v7.2 branch with 'auto-firmware-upgrade' disabled to v7.4.5, v7.4.6, or v7.4.7 will automatically enable FortiGuard updates without user acknowledgment.

 

Example:

Existing version before upgrade: v7.2.11:

 

config system global
    set gui-auto-upgrade-setup-warning disable
end

config system fortiguard
    set auto-firmware-upgrade disable
    set gui-prompt-auto-upgrade disable
end

config system federated-upgrade
    set status disabled
end

 

After upgrading to v7.4.8 or v7.6.3, the first login will trigger a GUI warning prompt if automatic firmware updates were previously disabled but are now enabled:

 

GUI Prompt after upgradeGUI Prompt after upgrade

 

Related documents: