Technical Tip: Manual firmware upgrade by referring to an upgrade path

[ppatel]

Description

This article describes the steps to perform firmware upgrade manually by referring to a correct upgrade path (GUI).

Scope

FortiGate.

Solution

Option 1. Verify the upgrade path by following these steps:

1. Login to the support portal (support.fortinet.com).
2. Go to Support -> Firmware Download. 

3. Select Product: FortiGate -> Upgrade Path.

4. Select the product model (Current Product).
5.  Select the current device firmware version and upgrade to firmware version details.

Note:

To check the upgrade path for firmware v5.2.9, check the related article link shared at the end of this article.

To download the image files, navigate to the support portal, go to: support.fortinet.com -> Support -> Firmware Download, Select Product: FortiGate, and 'Download'.

Navigate to the required firmware version, locate the image file, and select HTTPS as in the example below. Note that 'pop-ups' must be allowed on the web browser for the HTTPS button to work. 

Example: FortiGate 100F.
File name starts with -> FGT_100F.
Select 'HTTPS' to start the download.

If the FortiGate is managed by FortiManager, check the firmware compatibility between the FortiGate and FortiManager before performing the upgrade

https://docs.fortinet.com/compatibility-tool/fortimanager

Example: If FortiGate is scheduled to upgrade to 7.2.11 and the FortiManager 7.4.5 is on firmware version from the below screenshot, compatibility does not match, but 7.2.10 is compatible. Similarly, for any upgrade of the FortiOS firewall have to make sure compatible. 

Backup Configuration: 

To backup the configuration file, go to the Admin Profile icon in the top right corner -> Configuration -> Backup. 

Note: To download the full configuration file from a FortiGate, the user must be logged in with a super admin profile. Backups created using a Prof Admin account may be incomplete, and restoring such a file can lead to the removal of all Super Admin accounts from the system.

This would prevent access to restore backups or perform system-level changes until a Super Admin account is recovered. For further details, refer to the official Fortinet documentation: Technical Tip: Prof_Admin admin profile will not be able to back up the Super_Admin.

To upgrade the firmware in the GUI v5.4.x:

1. Log in to the FortiGate GUI as the admin administrative user.
2.  Go to Dashboard -> System Information.
3.  Select 'Update' before ‘Firmware Version’, then select Browse and locate the previously downloaded firmware image file.

Select Backup config and upgrade.

 Upgrade the firmware from GUI v5.6.x, v6.x+:

1. Log in to the FortiGate GUI as the admin administrative user.
2. Go to System -> Firmware.
3. Under Upload Firmware, select Browse and locate the previously downloaded firmware image file.
4. Select 'Backup config and upgrade'

The FortiGate backs up the current configuration to the management computer, uploads the firmware image file, upgrades to the new firmware version, and restarts.
This process takes a few minutes.

Upgrade the firmware from GUI v7.0.x, v7.2.x, and v7.4.x:

1. Log in to the FortiGate GUI as the admin administrative user.
2. Go to System -> Fabric Management (v7.0.x/v7.2.x) or Firmware & Registration (v7.4.x).
3. Choose the FortiGate, select Upgrade, select File Upload, select Browse, and locate the previously downloaded firmware image file.
4. Select 'Confirm and Backup Config'.

Upgrade the firmware from GUI v7.6.x:

1. Log in to the FortiGate GUI as the admin administrative user.
2. Go to System -> Firmware & Registration.
3. Choose the FortiGate, select Upgrade, select FortiGate Only, and select Next.
4. Select File Upload, locate the previously downloaded firmware image file, and select Next.
5. In Upgrade Schedule, select Immediate, select Next, Select Confirm and Backup Config.

Note:

For the units in HA, push the firmware image file in the master device only, and first, the slave device will get upgraded, and later it will take the master position, and another device will be upgraded.
After every image version upgrade, ensure both devices are in sync before proceeding with further upgrades. Upgrading the HA devices and getting in sync will take around 30 minutes.

Note:
Starting from v7.0.6, to upgrade firmware from the GUI:
Go to System -> Fabric Management, select the FortiGate, and select Upgrade. The FortiGate Upgrade pane opens and provides an option for selecting the firmware. 

• For v7.4.x, firmware upgrade under System -> Firmware & Registration.
• Check the screenshots below showing the upgrade procedure in v7.4.x.
• Go to System -> Firmware & Registration.

• Select the Device and select Upgrade.
• Select the file upload option and add the appropriate firmware image downloaded from the support portal.

Related articles:

Troubleshooting Tip: FortiGate Supported Legacy Upgrade Paths.

Technical Tip: How to manually perform firmware upgrade from GUI.

Technical Tip: How to Upgrade FortiGate Firmware.

Technical Tip: FortiGate FortiOS Upgrade Path