Technical Tip: How to disable automatic firmware upgrades on FortiGates

[ManpreetSingh]

Description	This article provides instructions to disable automatic firmware upgrades on FortiGate devices through FortiManager and FortiGuard.
Scope	FortiGate, FortiManager.
Solution	Disabling Firmware Upgrades through FortiManager. To disable automatic firmware upgrades on FortiGate devices managed by FortiManager, perform the following steps: config system central-management     set allow-push-firmware disable     set allow-remote-firmware-upgrade disable end set allow-push-firmware disable: Disables the ability to push firmware updates from the central management system (FortiManager) to the FortiGate devices. This prevents firmware updates from being pushed to the devices. set allow-remote-firmware-upgrade disable: Disables the ability to perform remote firmware upgrades on the FortiGate devices from the central management system (FortiManager). This prevents remote firmware upgrades from being initiated.                                                               Disabling Auto-Firmware Upgrade through FortiGuard. To disable the auto-firmware upgrade feature through FortiGuard, perform the following steps: config system fortiguard     set auto-firmware-upgrade disable  <----- Disable automatic patch-level firmware upgrade from FortiGuard.     set gui-prompt-auto-upgrade disable end This auto-firmware-upgrade feature is only available for FortiGate v7.2.1 and later.  Automatic firmware upgrade cannot be enabled for FortiGates belonging to a Security Fabric, FortiGates under management by a FortiManager, or a secondary HA FortiGate. However, HA groups will still have automatic firmware upgrades based on the primary FortiGate. When automatic firmware upgrades are enabled, FortiSwitch and FortiAP firmware will also be updated as part of the federated update. Automatic upgrades will only upgrade to a newer patch within that major version. For example, a FortiOS version v7.2.x image will only auto-upgrade to another v7.2.x image. It will not upgrade to a v7.4.x image. From the GUI it can be done from the option System -> Firmware Registration -> Automatic patch upgrade enabled -> Disable automatic patch upgrades. config system federated-upgrade     set status disabled end Cancel Any Scheduled Upgrades. Run the following command to cancel any immediate or scheduled upgrades: execute federated-upgrade cancel This command will prompt the user to confirm the cancellation: Type Y and enter.                      Note: To completely deactivate automatic patch upgrades for a FortiGate connected to FortiGate Cloud, ensure to disable the patch upgrade settings within FortiGate Cloud as well. Additional Note: Starting with v7.4.8, v7.6.4, and v8.0.0, a new behavior has been introduced on unlicensed or expired-support FortiGate devices. If support is not valid, the FortiGate will automatically schedule a firmware upgrade to the latest patch in its current minor version. This is managed through the CLI under 'config system federated-upgrade', where the upgrade schedule becomes visible. However, this scheduled upgrade cannot be cancelled, only postponed for up to seven days using the command 'execute auto-upgrade delay-installation'. There is no limit on the number of times this can be delayed.​ For more details, read the article: Technical Tip: Disable auto-upgrade for unlicensed FortiGates Note: If from the GUI, under Firmware Registration, there is no Disable automatic patch upgrade, the following path can be checked under System -> FortiGuard. Related article: Technical Tip: Disable auto-upgrade for unlicensed FortiGates