Technical Tip: Upgrading IPS Engine on the primary FortiGate will also upgrade the backup FortiGate

[nathan_h]

Description	This article explains how upgrading the IPS Engine on a High Availability (HA) Cluster with FortiGate devices also upgrades FortiGate backups.
Scope	FortiGate.
Solution	The following information before performing an IPS Engine upgrade. The command below shows that IPS Engine 7.00043 is in use on the Primary FortiGate. FGT_1 # diagnose autoupdate versions | grep -A 2 "IPS A" IPS Attack Engine --------- Version: 7.00043 FGT_1 # get system status | grep HA Current HA mode: a-p, primary The following command is used to move to the secondary unit in an HA Cluster: FGT_1 # execute ha manage 0 admin FGT_2 # get system status | grep HA Current HA mode: a-p, secondary FGT_2 # diagnose autoupdate versions | grep -A 2 "IPS A" IPS Attack Engine --------- Version: 7.00043 All units in the HA Cluster are running the same IPS Engine 7.00043. Upgrade the IPS Engine on the Primary FortiGate: Go to System -> FortiGuard -> Intrusion Prevention -> Actions -> Upgrade Database -> Select file -> Upload the IPS Engine and select 'OK' (even though the Upgrade Database button is next to the IPS Definitions field, the IPS engine will be upgraded). Once the IPS Engine has been upgraded successfully, use the command below to restart the ipsmonitor process: diagnose test application ipsmonitor 99 Note: Performing the activity of upgrading the IPS engine will terminate all TCP sessions.  After the IPS Engine upgrade. FGT_1 # get system status | grep "Version:\|HA" Version: FortiGate-VM64 v7.0.2,build0234,211019 (GA) Current HA mode: a-p, primary FGT_1 # diagnose autoupdate versions | grep -A 2 "IPS A" IPS Attack Engine --------- Version: 7.00044 FGT_1 # execute ha manage 0 admin FGT_2 # get system status | grep "Version:\|HA" Version: FortiGate-VM64 v7.0.2,build0234,211019 (GA) Current HA mode: a-p, secondary FGT_2 # diagnose autoupdate versions | grep -A 2 "IPS A" IPS Attack Engine --------- Version: 7.00044 The above output shows that IPS Engine 7.00044 is running on both units of the HA Cluster. Note that upgrading the IPS Engine on a Primary unit automatically upgrades it on the second unit as well. All FortiOS images come with built-in IPS Engines. In case FortiOS is upgraded and the target build has the same version of ipsengine as the current FortiOS build, it is necessary to reload ipsengine after a firmware upgrade. Related article: Technical Note: How to manually upgrade the IPS Engine Note: Primary and secondary devices should have a valid license. If the device has an evaluation license or no valid license, updating the database is not allowed.