FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
rvillaroman
Staff
Staff
Article Id 317013
Description This article describes how to recover the previous firmware and config using the console after the FortiOS upgrade.
Scope FortiGate.
Solution

Scenario:

In some cases after an upgrade, the device is unable to boot or unable to login. This may be due to following the incorrect path or a corrupted firmware image file.

 

Picture1.png

 

As the admin user is unable to log in to the device, the possible option are:

 

  1. Hard Reset the device. See Technical Tip: How To Reset To Factory Default Configuration using external button.
  2. Initializing the firewall using the backup firmware. A console cable is necessary for this. See Technical Tip: How to connect to the FortiGate and FortiAP console port.
  3. Once the console cable is connected follow this process:
  • Reboot the device and press any key to display the configuration menu.
  • On the configuration menu, press B.

Note:

In some scenarios, PuTTY becomes unresponsive after a reboot. Downloading the Tera Term terminal emulator tool is recommended, as it does not encounter the same issue and allows for key presses to display the configuration menu easily. Tera Term can be downloaded from this GitHub link https://github.com/TeraTermProject/teraterm/releases/tag/v4.108. The recommended TeraTerm version is 4.108, as TeraTerm version 5.x is incompatible with the TAC script.

 

[B]: Boot with backup firmware and set as default.

Picture2.png

 

The FortiGate will boot on the previous working firmware version.

With the 'diagnose sys flash list' command, it is possible to verify the backup and the current working firmware. 

Picture3.pngPicture3.png

 

  1. If the previous steps did not work, upload the firmware version of the firewall using the config menu. See this guide.

 

Related article:  

Technical Tip: Selecting an alternate firmware for the next reboot