| Solution |
Starting with FortiOS versions 7.4.8 and 7.6.4, a new behavior has been introduced on unlicensed or expired-support FortiGate devices. See Automatic firmware upgrades for FortiGate appliances with invalid support contracts or that have rea....
If support is not valid, the FortiGate will automatically schedule a firmware upgrade to the latest patch in its current minor version. This is managed through the CLI under 'config system federated-upgrade', where the upgrade schedule becomes visible. However, this scheduled upgrade cannot be cancelled, only postponed up to seven days using the command 'execute auto-upgrade delay-installation'. There is no limitation on how many times the schedule can be changed. However, once the new image has been checked and confirmed, the installation must occur within 1–14 days from that date. Regardless of how many times the schedule is modified, it cannot be postponed beyond this 14-day window.
For some users, especially those in sensitive environments or with strict change control, unexpected automatic upgrades can be disruptive. The lack of a true cancellation option poses operational challenges if maintenance windows or specific upgrade requirements exist.
Quick Solution: FortiManager Configuration:
A simple workaround is to connect the FortiGate to a FortiManager, which immediately cancels the automatic upgrade process. This can be achieved by entering the following CLI commands:
config system central-management
set type fortimanager
end
After configuring the above commands, the following message will appear.
The Serial Number for FortiManager is not entered.
In order to verify identity of FortiManager serial number is needed.
If serial number is not set, connection will be set as unverified.
FortiGate can establish a connection to obtain the serial number now.Do you want to try to connect now? (y/n)n
Press 'n'. The configuration will be committed. Otherwise, it will continuously display the same message.
No FortiManager IP is required in the configuration for versions beginning with 7.2.9, 7.4.4, and 7.6.0. The forced upgrade mechanism will be disabled simply by enabling the FortiManager management type.
From a security hardening perspective, note that this does not open any additional inbound ports on the firewall. This is instead controlled by the FMG-Access setting, regardless of the central-management setting, see Technical Tip: Explaining FMG-Access on FortiGate Interface Settings. If FortiManager will not be in use, it is recommended to disable FMG-Access on all interfaces.
|
