FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes how to choose a suitable FortiOS version.
Scope
FortiGate.
Solution
Common clarification when planning to choose the FortiOS version suitable for each environment:
As an initial step, ensure that the firewall is running a supported FortiOS version according to the Product Life Cyclefor the FortiGate equipment. It is necessary to update/upgrade to a supported FortiOS version to seek help.
Each FortiOS version (7.6.x; 7.4.x; 7.2.x; 7.0.x) has different features and is NOT compatible with all models of FortiGate equipment. Verify the update/upgrade eligibility of the selected FortiOS version of each device specified under the version Release Notes -> Supported Models.
The first two digits (7.6.x; 7.4.x; 7.2.x; and 7.0.x) of the FortiOS represent the version while the x digit represents the patch of the current version.
When upgrading to the newer supported version (for example: from 7.0.x to 7.6.x, from 7.2.x to 7.6.x, from 7.4.x to 7.6.x, from 7.0.x to 7.2.x, from 7.0.x to 7.4.x, or from 7.2.x to 7.4.x):
Does NOT necessarily denote that is more secure version unless a clear instruction is suggested by the TAC Representative or PSIRT Advisories.
Does NOT necessarily address a vulnerability concern, unless a clear instruction is suggested by the TAC Representative or PSIRT Advisories.
A FortiConverter Servicelicense is required whenever the Upgrade Path cannot be respected. (Configuration can get corrupted if the upgrade path is not followed strictly).
Upgrades should be planned accordingly.
Having an HA Cluster is always recommended as a suitable business continuity requirement.
When ready, strictly follow the instructions of the following article: How to upgrade FortiGate firmware. Make sure to acknowledge the advice provided in the Usage awareness and preparation checklist before the upgrade section.
Involving a TAC Support Representative:
The TAC Representative is not equipped to recommend any stable patch or version. That decision falls solely to the client's technical team based on the environment and features in use.
The TAC Representative is not advised to be on standby nor perform the updates/upgrades on the team's behalf. This responsibility falls solely to the client's technical team.
