Backup config Fortigate

[keurdange]

Hi,

I have two FTG-60C: one is running the firmware 4.3.7 and I updated the second one to the firmware 5.2.7. Here is my question: Can I backup the config on the fortigate which runs the firmware 4.3.7 and restore it back to the other one which runs the firmware 5.2.7? What is the best way to do this? I want the config of fortigate which runs the firware 5.2.7 to be the same that the one which runs the firmware 4.3.7.

Sorry if my english was bad. I'm french speaker.

Thanks in advance.

[keurdange]

Yes, the second one runs 5.2.7 already but I just upgraded it (day before yesterday). The first is still running 4.3.7 and I'm afraid to upgrade it because with this link, I always format the device. But I'll try to update the first with the update link by following the upgrade path.

Perform update with the update link is just like upload a picture to facebook (for example)? Or, I have to do something else first (except backup the config)?

[journeyman]

Yes it's nice to format the device for a firmware install. However in this case you need a configuration file to match the firmware version. You do not yet have this.

I tend to use the console for this work; tftp for the initial firmware load then usb for configuration and firmware upgrades.

I suggest you revert the 5.2.7 to 4.3.7 and proceed like this:

Obtain firmware versions 4.3.7, 4.3.11, 4.3.18, 5.0.13, 5.2.7

Take unit running 5.2.7. Connect your console. Boot to configuration menu

Format the device

Load 4.3.7 via tftp, save as default, let the unit reboot completely

Log in, load your configuration (via usb or otherwise)

Let the unit reboot completely. watch the console during the reboot and check for error messages (none expected here).

Unit is now 4.3.7 with your configuration

Upgrade to 4.3.11 via usb or otherwise, the unit will reboot, check error messages (some errors may not matter)

Upgrade to 4.3.18 as above

Upgrade to 5.0.13 as above

Upgrade to 5.2.7 as above

Finished! Device is now running 5.2.7 with your configuration.

You can now upgrade the running device as follows:

Format, load 5.2.7, load 5.2.7 configuration, finished.

The alternative is to cut and paste the important parts of your 4.3.7 configuration into a default 5.2.7 configuration. It's certainly possible but the above is easier.

Apologies I did not watch the video to find why you're afraid to upgrade.

[keurdange]

Ok, thank you too for your answer Journeyman. I'll try it too.

In the video, they always format before installing the firmway. This is why I'm afraid to always format my device. For the second 60C, I have formatted it always before upgrading because it is a new device (with no configuration).

[journeyman]

Once you have completed the firmware upgrade path procedure and you have the unit running 5.2.7 with your configuration, you could then do a final clean up - reboot, format, reload 5.2.7, reload your configuration.

The point of the upgrade path procedure is to convert your configuration from 4.3.7 to 5.2.7 without (or with minimal) manual effort.

You could also do the upgrade on the the device currently running 4.3.7 and then copy the resulting configuration to the device running 5.2.7. It depends what sort of outage you can tolerate.

[Dave_Hall]

Personally, if going from 4.3.x->5.0.x->5.2.x, I'd may consider rebuilding the 5.2.x configuration from scratch - there is a lot of "junk settings" left over from 4.3 that is imported over to 5.0.x and again from 5.0.x over to 5.2.x - some of these settings may no longer be used or have been alternated from the original operation.  Rebuilding he config would also give you a chance to perform a "clean up" on the config. 

If you have access to two of the same fgt models, I'd would have one running the 4.3.x firmware w/ old config and the other running 5.3 firmware running a factoryreset config.  Have the GUI open on both fgts, and just build/replicate the settings from one fgt to the other fgt.

Do read the patch notes, both for the major firmware release and the firmware patch release you are upgrading to.  There are few "gotchas", like the implicit fall-through feature to user authentication introduced in 5.2.

[Toshi_Esumi]

I agree to Dave depending on what the existing config has. We were using 4.3 until about 3 years ago then had to migrate to different chassis. So we manually converted config for multiple vdoms. We had to clean up, or not to copy, many parts because different chassis and new version might have different default values in config for the same features.