Technical Tip: How to upgrade FortiGate using FortiManager

lingky88 · ‎12-30-2022

Description

This article explains how to upgrade FortiGate through FortiManager.

Scope

Any supported FortiGate, FortiManager version.

Solution

Prerequisite:

The FortiGate needs a valid upgrade license (FMWR license).

To check the FortiGate license on FortiManager, use the following FortiManager CLI command:

diagnose fmupdate fds-dump subs

Upgrade a FortiGate:

Under Device Manager -> Managed FortiGate, double-click on the FortiGate to upgrade. Under the Firmware Version section, select Upgrade Firmware.

Select the appropriate version/image and select Upgrade.

Note: The new layout as of version 7.4 is shown below:

A prompt will be shown before the Upgrade. Select OK to proceed.

Track the progress of the upgrade. Wait for it to complete successfully.

Alternatively, upgrade using a Firmware Template:

Assign a firmware template under Device Manager -> Firmware Templates -> Create New.
Create a new firmware template and select the platform and the firmware version under the Upgrade Details section.

It is recommended to upgrade based on the recommended upgrade path under the Upgrade Path option.

After the firmware template has been created, assign the device to this template by right-clicking the template and selecting the Assign to Device/Group options. Next, move the FortiGate(s) into the Selected Entries section and select OK.

The selected devices assigned to the Firmware Templates will be shown.

Check under the Device Manager page that the firmware template has been assigned under the managed devices.

To upgrade, go back to the firmware templates, right-click on the correct template and select Upgrade Now to which will prompt an upgrade of the FortiGate(s).

Select OK to upgrade the devices assigned to the template and wait for the upgrade to complete successfully.

Solution for FortiGates in HA cluster, which are being managed by the FortiManager:

The FortiGate HA is upgraded the same way as the FortiManager as a standalone FortiGate. The Firmware template might seem a little confusing as the 'Assign Device' section only shows the primary FortiGate and not the secondary cluster member. However, that is by design as the FortiGate is a HA cluster and FortiManager always communicates with the primary member. The secondary member should get upgraded automatically if the HA is in good shape.

When performing an upgrade of FortiGate via FortiManager, it is important to run debug from the FortiManager and FortiGate sides.

Debug from FortiManager:

diagnose fwmanager fwm-log <----- Live debug when upgrading FortiGate.

Debug from FortiGate: (Possibly run through the console):

Lotus-kvm05 # diagnose debug cli 8

Lotus-kvm05 # diagnose debug en

The task Job will be displayed from the Task Monitor at FortiManager.

Complete task from FortiManager:

Troubleshooting:

The following CLI commands are used for troubleshooting firmware issues from FortiManager:

diagnose fwmanager fwm-log
diagnose fwmanager service-restart

Related articles: