FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
gmanea
Staff
Staff

Description
This article describes how to revert to the previous firmware image, how to rollback FortiOS after an upgrade.
Solution
The following CLI command lists the FortiOS image files installed in both partitions:

FGT # diag sys flash list
Partition    Image                       TotalSize(KB)   Used(KB)  Use%    Active
1            FGT61E-6.04-FW-build1778-201021    253920      87604   35%    Yes   
2            FGT61E-6.04-FW-build1803-201209    253920      88660   35%    No  
3            ETDB-84.00660                     3021708     200120    7%    No   
Image build at Dec  9 2020 22:27:52 for b1803

As per the above output, partition 1 can be seen to be active and holds the current firmware (6.4.3, while the secondary is on 6.4.4).

To revert to the previous or other firmware use the following commands through the CLI and select which firmware should be used at the next reboot:

FGT# execute set-next-reboot {primary | secondary} <-----In this example it will be secondary.
FGT# execute set-next-reboot secondary

Default image is changed to image# 2.

Primary and Secondary simply refer to the partition number 1 or partition number 2 respectively. Partition number 3 can be ignored.

Once the secondary partition that is to be used to boot the device has been selected, reboot the FortiGate.

This can be done using the command:

FGT # execute reboot

The CLI command can then be used to verify that the FortiGate has rebooted from the secondary partition. [See the example below].

FGT # diag sys flash list
Partition    Image                       TotalSize(KB)   Used(KB)  Use%    Active
1            FGT61E-6.04-FW-build1778-201021    253920      87604   35%    No   
2            FGT61E-6.04-FW-build1803-201209    253920      88660   35%    Yes  
3            ETDB-84.00660                     3021708     200120    7%    No   
Image build at Dec  9 2020 22:27:52 for b1803

VDOM administrators do not have permission to run this command. It must be executed by a super administrator.
After an upgrade this will automatically change (here from 6.4.4 to 6.4.5):

FGT # diag sys flash list
Partition    Image                       TotalSize(KB)   Used(KB)  Use%    Active
1            FGT61E-6.04-FW-build1828-210217    253920      87396   34%    Yes   
2            FGT61E-6.04-FW-build1803-201209    253920      88660   35%    No  
3            ETDB-84.00660                     3021708     157240    7%    No   
Image build at Feb 17 2021 20:43:28 for b1828

Note:
1) That rebooting the FortiGate from the other partition will cause the loss of any configuration changes that were made since the upgrade.

2) In HA environments, the command needs to be applied to each unit in the cluster individually. This is not synchronized and will not automatically take effect on other units in the cluster.

3) FortiToken licenses, once added to any of the units, are kept and shared between the units of the cluster. Therefore, a reboot (or shutdown) of a unit in HA should not impact the operation or usage of FortiTokens through the remaining unit. When a downgrade is performed as above, the unit will load the previous configuration (with Fortitokens in the same state and assigned as they were before the last upgrade). This may be useful when the token licenses are not validated correctly following an upgrade.
Related document.
https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/616209/set-next-reboot

Related Articles

Technical Tip: How to revert HA cluster unit to the previous firmware image

Contributors