Technical Tip: Automatic patch upgrades

Description

This article describes how to configure automatic patch upgrades:

The upgrade will only be performed on a patch within the same major release version.

Scope

FortiGate v7.2.1 and above.

Solution

Configurations in the GUI:

Go to System -> Firmware & Registration -> Automatic patch upgrades enabled/disabled:

When automatic patch upgrade is enabled, the patch-level upgrade will be scheduled after 'Delay by a number of days' during the specified time.

The patch-level upgrade can also be scheduled by specifying the days of the week during the specified time.

After the patch release is successfully installed, the automation stitch 'Firmware upgrade notification' will be triggered to send an email notification.

Note: If the Automatic patch upgrades enabled/disabled is not found at the mentioned path, it is possible to find it at the following GUI path: System -> FortiGuard (automatic upgrade enabled/disabled).

Configurations in the CLI:

config system fortiguard
    set auto-firmware-upgrade {enable | disable}
    set auto-firmware-upgrade-day {sunday monday tuesday wednesday thursday friday saturday}
    set auto-firmware-upgrade-delay <integer>
    set auto-firmware-upgrade-start-hour <integer>
    set auto-firmware-upgrade-end-hour <integer>
end

To review the installation window of new patch releases:

diagnose test application forticldd 13
Scheduled push image upgrade: no 
Scheduled Config Restore: no
Scheduled Script Restore: no
Automatic image upgrade: Enabled.
Next upgrade check scheduled at (local time) Thu Sep 7 12:35:37 2023
New image 7.4.1b2463(07004000FIMG0024804001) installation is scheduled to
start at Sun Sep 10 11:48:26 2023
end by Sun Sep 10 23:00:00 2023

The event log after configuring the automatic firmware upgrade:

date=2023-09-08 time=16:21:50 eventtime=1694204482840500060 tz="-0400" logid="0100032263" type="event" subtype="system" level="notice" vd="root" logdesc="Automatic firmware upgrade schedule changed" user="system" msg="System patch-level auto-upgrade regular check enabled."

Note: This alert is triggered every time the FortiGate is rebooted.

The event log after successfully updating the firmware:

date=2023-09-08 time=16:21:50 eventtime=1694204482991730680 tz="-0400" logid="0100022094" type="event" subtype="system" level="information" vd="root" logdesc="A federated upgrade was completed by the root FortiGate" msg="Federated upgrade complete" version="7.4.1"

The event log firmware upgrade notification is triggered:

date=2023-09-08 time=16:21:51 eventtime=1694204510384715240 tz="-0400" logid="0100046600" type="event" subtype="system" level="notice" vd="root" logdesc="Automation stitch triggered" stitch="Firmware upgrade notification" trigger="Auto Firmware upgrade" stitchaction="Email Notification" from="log" msg="stitch:Firmware upgrade notification is triggered."

Starting with FortiOS versions 7.4.12, 7.6.7, and 8.0.0, email notification for firmware upgrade has been improved for better clarity. These notifications can be triggered using automation actions 'Auto Upgrade Complete Email Notification', 'Auto Upgrade Cancelled Email Notification', and 'Auto Upgrade Scheduled Email Notification'.

Additionally, it also introduces a new default automation stitch, Firmware Upgrade Complete, along with a new automation trigger, Auto Firmware Upgrade Complete. The details can be found in the release notes New Features or enhancements.

From versions 7.2.6 and 7.4.0 to 7.4.4, the 'auto-firmware-upgrade' CLI setting will be enabled by default in most of the 1-rack-unit platforms.

FortiGates that FortiManager manages or acts as Fabric root or Fabric leaf members will not be affected by this change.

The complete list of the platforms that will be affected by this change is as follows:

• FortiGate-40F.

• FortiGate-40F-3G4G.

• FortiGate-60E.

• FortiGate-60E-DSL.

• FortiGate-60E-DSLJ.

• FortiGate-60E-POE.

• FortiGate-60F.

• FortiGate-61E.

• FortiGate-61F.

• FortiGate-70F.

• FortiGate-71F.

• FortiGate-80E.

• FortiGate-80E-POE.

• FortiGate-80F.

• FortiGate-80F-BP.

• FortiGate-80F-POE.

• FortiGate-81E.

• FortiGate-81E-POE.

• FortiGate-81F.

• FortiGate-81F-POE.

• FortiGate-90E.

• FortiGate-91E.

• FortiGate Rugged-60F.

• FortiGate Rugged-60F-3G4G.

• FortiGate Rugged-70F.

• FortiGate Rugged-70F-3G4G.

• FortiWifi-40F.

• FortiWifi-40F-3G4G.

• FortiWifi-60E.

• FortiWifi-60E-DSL.

• FortiWifi-60E-DSLJ.

• FortiWifi-60F.

• FortiWifi-61E.

• FortiWifi-61F.

• FortiWifi-80F-2R.

• FortiWifi-81F-2R.

• FortiWifi-81F-2R-3G4G-POE.

• FortiWifi-81F-2R-POE.

Starting from v7.4.5, the 'auto-firmware-upgrade' CLI setting will be enabled by default for all models, including FortiGate VMs. This means the system will automatically upgrade to the latest firmware unless manually configured otherwise.

See: Automatic firmware upgrade control.

From version 7.4.5 and above, the option to control automatic firmware upgrades has been updated. Previously, this option was enabled only on entry-level models and disabled by default on all other models, allowing users to manually control firmware upgrades.

Starting with v7.4.8, v7.6.4, and v8.0.0, a new behavior has been introduced on unlicensed or expired-support FortiGate devices: if support is not valid, the FortiGate will automatically schedule a firmware upgrade to the latest patch in its current minor version. This is managed through the CLI under 'config system federated-upgrade', where the upgrade schedule becomes visible.

However, this scheduled upgrade cannot be cancelled, only postponed up to seven days using the command 'execute auto-upgrade delay-installation'; there is no limit on the number of times this can be delayed.​ 

Related articles:

Technical Tip: Understanding Automatic Patch Upgrade: FortiGate Cloud Premium vs Local Setting

Technical Tip: How to disable automatic firmware upgrades on FortiGates

Technical Tip: Schedule firmware upgrade by GUI