Automatic Updates for FortiManager Integrated with FortiGate question.

[DongHwan1]

Hello,

I would like to inquire about the automatic update management for FortiManager that is integrated with FortiGate and the Security Fabric.
Could you please provide information on how automatic updates are handled in this setup?

As far as I know, when a FortiGate is connected to a FortiManager, the FortiGate shows that automatic updates are enabled, and because it is managed by the FortiManager, the option to disable automatic updates is not available on the FortiGate.

So, does this mean that automatic updates are not actually performed on FortiGates that are managed by FortiManager?

I would like to perform updates manually when I want, and I do not want automatic updates to be applied.

Is there anything that needs to be configured separately on the FortiManager side?

Thaks all.

[Toshi_Esumi · Accepted solution]

Not sure if you want to do in the same way we do for those FMG managed FGT's upgrade. But those three commands in my post below are basically what we put in those FGTs.
https://community.fortinet.com/t5/Support-Forum/Stop-auto-firmware-upgrade-via-FMG/td-p/370165
Although no one in this community confirmed or denied my post, so far it seems to be working as intended.

Toshi

[kaman · Accepted solution]

Hi DongHwan1,

Check the config system central-management settings.

How to disable management tunnel to FortiGate Cloud

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-management-tunnel-to-FortiG...

Disabling the management tunnel can be done through the CLI:

Note this configuration also disables central management by FortiManager.

config system central-management
set type none
end

Disabling Firmware Upgrades through FortiManager.

To disable automatic firmware upgrades on FortiGate devices managed by FortiManager, perform the following steps:

config system central-management
set allow-push-firmware disable
set allow-remote-firmware-upgrade disable
end

Please refer to the document below for more information:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-automatic-firmware-upgrades....

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards,
Aman

[Toshi_Esumi · Accepted solution]

Not sure if you want to do in the same way we do for those FMG managed FGT's upgrade. But those three commands in my post below are basically what we put in those FGTs.
https://community.fortinet.com/t5/Support-Forum/Stop-auto-firmware-upgrade-via-FMG/td-p/370165
Although no one in this community confirmed or denied my post, so far it seems to be working as intended.

Toshi

[DongHwan1]

Thank you for clarifying! 

Before I start writing, I read your post. I followed your instructions for the setup, and it seems to be working as intended. Thank you.
However, with this setup, it seems impossible to push updates from FortiManager to the gate. I think it might be better if partial support is provided so that updates can be made from the manager to the gate. Thank you for your response!

[kaman · Accepted solution]

Hi DongHwan1,

Check the config system central-management settings.

How to disable management tunnel to FortiGate Cloud

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-management-tunnel-to-FortiG...

Disabling the management tunnel can be done through the CLI:

Note this configuration also disables central management by FortiManager.

config system central-management
set type none
end

Disabling Firmware Upgrades through FortiManager.

To disable automatic firmware upgrades on FortiGate devices managed by FortiManager, perform the following steps:

config system central-management
set allow-push-firmware disable
set allow-remote-firmware-upgrade disable
end

Please refer to the document below for more information:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-automatic-firmware-upgrades....

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards,
Aman

[DongHwan1]

It's a bit disappointing that the central management feature of FortiManager is also disabled. There may be situations where updates need to be made from the manager, but in any case, I think I should keep using this option.

Thank you for your response!

[sw2090 · Accepted solution]

hm we are using FMG with several FGT for years now. 

As far as firmware upgrades are concerned: our FMG never automatically updated any FGT. It probably would if you set up a firmware template that tells it to do so. It can do scheduled upgrade on demand though if you create a template for that and add some fgt to the template that have a valid firmware upgrade license.

Config updates per default are only pushed from FGT to FMG (only device config) automatically (AutoUpdate). You can configure what should be pushed automatically in the adom settings in fmg.