60-E 7.2.3 HA Upgrade Failure

[NotMyRealName]

Hi there,

I've got a pair of 60-E's running 7.2.2.

After the PSIRT published yesterday, I've tried upgrading them to 7.2.3.

I've done other upgrades in the past and not had any problems, this time my secondary failed to upgrade.

FW-2 is primary.

Initiate a fabric upgrade.

See the HA links go down.

FW-1 is now primary and upgraded.

FW-2 never completed the upgrade. After logging into it via the HA link it says it's still on the older 7.2.2 firmware. Same after a manual (software reboot).

I've ended up pulling power to the secondary and will have to attend site tomorrow; I'm wondering if people have any advice for getting the secondary upgraded properly.

I've seen instructions for manually performing a firmware upgrade from a USB stick, and am wondering if this is the best thing to do on the secondary unit so they're both the same version at least.

I've got a Fortigate 60E - can I confirm that `FGT_60E-v7.2.3.F-build1262-FORTINET.out`is the correct firmware file I should be using?

Any thoughts or advice greatly appreciated.

[gfleming]

This should work without error. I'm wondering if your HA cluster was healthy before upgrade? Did you confirm HA sync and checksums?

https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/247944/upgrading-fortigates-...

You should be able to get on to FW-2 from FW-1 and upgrade using CLI.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Managing-individual-cluster-units-with-the...

https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/596131/upgrading-individual-...

https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/946059/troubleshoot-an-ha-fo...

https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/63913/check-ha-synchronizati...