Technical Tip: Upgrading IPS Engine on the primary FortiGate will also upgrade the backup FortiGate

[nathan_h]

Description	This articles explains how upgrading the IPS Engine on a High Availability (HA) Cluster with FortiGate devices also upgrades FortiGate backups.
Scope	FortiGate.
Solution	Note the following information before performing an IPS Engine upgrade. The command below shows that IPS Engine 7.00043 is in use on the Primary FortiGate. FGT_1 # diag autoupdate versions | grep -A 2 "IPS A" IPS Attack Engine --------- Version: 7.00043 FGT_1 # get sys status | grep HA Current HA mode: a-p, primary The following command is used to move to the secondary unit in an HA Cluster: FGT_1 # exec ha manage 0 admin FGT_2 # get sys status | grep HA Current HA mode: a-p, secondary FGT_2 # diag autoupdate versions | grep -A 2 "IPS A" IPS Attack Engine --------- Version: 7.00043 All units in the HA Cluster are running the same IPS Engine 7.00043. Upgrade the IPS Engine on the Primary FortiGate. Go to System -> FortiGuard -> Intrusion Prevention -> Actions -> Upgrade Database -> Select file -> Upload the IPS Engine and select 'OK'. Once the IPS Engine has been upgraded successfully, use the below command to restart the ipsmonitor process: diag test application ipsmonitor 99 Note: Performing the activity of upgrading the IPS engine will terminate all TCP sessions.  After IPS Engine upgrade. FGT_1 # get sys status | grep "Version:\|HA" Version: FortiGate-VM64 v7.0.2,build0234,211019 (GA) Current HA mode: a-p, primary FGT_1 # diag autoupdate versions | grep -A 2 "IPS A" IPS Attack Engine --------- Version: 7.00044 FGT_1 # exec ha manage 0 admin FGT_2 # get sys status | grep "Version:\|HA" Version: FortiGate-VM64 v7.0.2,build0234,211019 (GA) Current HA mode: a-p, secondary FGT_2 # diag autoupdate versions | grep -A 2 "IPS A" IPS Attack Engine --------- Version: 7.00044 The above output shows that IPS Engine 7.00044 is running on both units of the HA Cluster. Note that upgrading the IPS Engine on a Primary unit automatically upgrades it on the second unit as well. All FortiOS images come with built-in ipsengines. In case FortiOS firmware is upgraded and target build has the same version of ipsengine as the current FortiOS build, it is necessary to reload ipsengine after a firmware upgrade. Related article: Technical Note: How to manually upgrade the IPS Engine Note: Primary and Secondary device should have valid license. Note: If device has evaluation license or no valid license, updating the database is not allowed.