Clarification on upgrades with manipulate partition - image OK, configuration not OK?

[AlexFerenX]

Hi!

KB "Keep the flash partition without it being overwritten (For rollback purposes)" seems useful, except, I think it's problematic. It basically, says, we can manipulate which into partition the new firmware image will be stored to keep (original firmware image in) the other partition from being overwritten during upgrade.

However, upgrade is not only about images, it's also about FortiOS configuration migration!!

As per KB, the partition into which the new firmware is one with "Active" is "No", but... (as I understand) the configuration used for FortiOS configuration migration will be sourced from partition with "Active" is "Yes".

So, in KB's step "Upgrade the firmware from 7.0.13 B0566 to 7.2.6 B1575:", the FortiOS configuration will be sourced from partition with the original "6.4.6" configuration, not the upgraded "7.0.13" configuration. And since that original FortiOS configuration was not migrated as per approved "Upgrade Path", we would end up with supposedly incorrect FortiOS configuration after the upgrade.

Is the above conclusion correct?

Thanks!

[AlexFerenX]

> Unlike Cisco, FGTs always "write mem" every time you make changes and exit from the particular config section in CLI or GUI ...

No - as I wrote, "if system global's "cfg-save" is set to 'manual'" - in this case, "running-configuration" and "startup-configuration" will diverge, until "execute cfg save".

> into the active partition/flash.

So, are you implying that at every configuration change to "startup-configuration", the partition with 'Active' flag set to 'Yes' is updated by that configuration change?

[Toshi_Esumi]

If the "cfg-save" is NOT "manual". Again, you have to "exit" from the config context like

config system interface
...

end

Toshi

[AlexFerenX]

> So, are you implying that at every configuration change to "startup-configuration", the partition with 'Active' flag set to 'Yes' is updated by that configuration change?

Can you comment/answer?

[Toshi_Esumi]

see above.

[Toshi_Esumi]

If you get in the same FGT with two browser sessions or CLI sessions, then change config on one side then "show" the config on the other side to see when it would be written.

Toshi

[AlexFerenX]

> see above.

Hmm.. With respect - I think you're wavering, here. A simple "yes" / "no" would be definitive. I've never seen any KB referring to dynamic modification of partition with 'Active' flag set to 'Yes' (ie. outside of upgrade context, which isn't the case here - now, context is, regular configuration changes) so, this is a crucial point.

[Toshi_Esumi]

"What you see is what you get". Test it yourself. It's so simple thing.

[AlexFerenX]

> "What you see is what you get". Test it yourself. It's so simple thing.

not at all..., since I cannot see the content of a partition. I've compared "Used(KB)" from "diagnose sys flash list" before and after a configuration change and saw no difference.

Edit: actually, "since I cannot see the content of a partition" isn't quite true, "fnsysctl ls -l /data/config" does work, but it shows GZ files whose content I cannot see.

[Toshi_Esumi]

I meant for the behaviors of upgrades and partitions.
And, I wouldn't have any further answers it might satisfy you. So open a ticket at TAC and ask the TAC person for your questions.

[AlexFerenX]

@Toshi_Esumi, thanks for your willingness to help.

> So open a ticket at TAC and ask the TAC person for your questions.

who are we kidding? Most of their answers are either borderline daft or irrelevant (likely, regurgitating a barely relevant KB) to expedite Ticket closure. I've yet to meet anyone in Fortinet Support who are as passionate and/or enthusiastic as handful of people like yourself.