Technical Tip: How to upgrade FortiGate using FortiManager

[Anonymous]

Description	This article explains how to upgrade FortiGate through FortiManager.
Scope	Any supported FortiGate, FortiManager version.
Solution	Prerequisite: The FortiGate needs a valid upgrade license (FMWR license). To check the FortiGate license on FortiManager, use the following FortiManager CLI command: diagnose fmupdate fds-dump subs Upgrade a FortiGate: Under Device Manager -> Managed FortiGate, double-click on the FortiGate to upgrade. Under the Firmware Version section, select Upgrade Firmware. Select the appropriate version/image and select Upgrade. Note: The new layout as of version 7.4 is shown below: A prompt will be shown before the Upgrade. Select OK to proceed. Track the progress of the upgrade. Wait for it to complete successfully. Alternatively, upgrade using a Firmware Template: Assign a firmware template under Device Manager -> Firmware Templates -> Create New. Create a new firmware template and select the platform and the firmware version under the Upgrade Details section. It is recommended to upgrade based on the recommended upgrade path under the Upgrade Path option. After the firmware template has been created, assign the device to this template by right-clicking the template and selecting the Assign to Device/Group options. Next, move the FortiGate(s) into the Selected Entries section and select OK. The selected devices assigned to the Firmware Templates will be shown. Check under the Device Manager page that the firmware template has been assigned under the managed devices. To upgrade, go back to the firmware templates, right-click on the correct template and select Upgrade Now to which will prompt an upgrade of the FortiGate(s). Select OK to upgrade the devices assigned to the template and wait for the upgrade to complete successfully. Solution for FortiGates in HA cluster, which are being managed by the FortiManager: The FortiGate HA is upgraded the same way as the FortiManager as a standalone FortiGate. The Firmware template might seem a little confusing as the 'Assign Device' section only shows the primary FortiGate and not the secondary cluster member. However, that is by design as the FortiGate is a HA cluster and FortiManager always communicates with the primary member. The secondary member should get upgraded automatically if the HA is in good shape. When performing an upgrade of FortiGate via FortiManager, it is important to run debug from the FortiManager and FortiGate sides. Debug from FortiManager: diagnose fwmanager fwm-log <----- Live debug when upgrading FortiGate. Debug from FortiGate: (Possibly run through the console): Lotus-kvm05 # diagnose debug cli 8 Lotus-kvm05 # diagnose debug en The task Job will be displayed from the Task Monitor at FortiManager. Complete task from FortiManager: Note: Upgrading FortiGate HA clusters using FortiManager could cause a network outage if triggered while a disk check is required on the FortiGate. For more information on this issue, refer to the following KB article: Troubleshooting Tip: FortiManager reboots the firewall HA cluster twice during a firmware upgrade, c... Troubleshooting: The following CLI commands are used for troubleshooting firmware issues from FortiManager: diagnose fwmanager fwm-log  diagnose fwmanager service-restart Note: When upgrading FortiGate HA from FortiManager, check if disk checking is enabled. If the disk check message appears on the Firewall, FortiManager will reboot the firewall first before sending the firmware image to the firewall. As per the proper process, reboot the primary firewall and then the secondary. However, note that in FortiManager, there is no wait time for the primary firewall to come up before rebooting the secondary firewall. Therefore, if firewalls (3600, 4400 or other high end  units) take more than 5 minutes to reboot, FortiManager will send the reboot command to the secondary, causing both firewalls to reboot at same time and causing network outages. This will also cause the only primary firewall to upgrade and the secondary firewall to remain on the same firmware version.    The workaround available is to disable the disk check on fmupdate before the upgrade using the following command: config fmupdate fwm-setting     set check-fgt-disk disable end Related articles: Troubleshooting Tip: FortiGate failed to upgrade using the Firmware Template  Technical Tip: How to check the FortiGate upgrade path on FortiManager  Technical Tip: How to download and import firmware images into FortiManager  Technical Tip: How to perform scheduled upgrade for FortiGates using FortiManager