Clarification on upgrades with manipulate partition - image OK, configuration not OK?

[AlexFerenX]

Hi!

KB "Keep the flash partition without it being overwritten (For rollback purposes)" seems useful, except, I think it's problematic. It basically, says, we can manipulate which into partition the new firmware image will be stored to keep (original firmware image in) the other partition from being overwritten during upgrade.

However, upgrade is not only about images, it's also about FortiOS configuration migration!!

As per KB, the partition into which the new firmware is one with "Active" is "No", but... (as I understand) the configuration used for FortiOS configuration migration will be sourced from partition with "Active" is "Yes".

So, in KB's step "Upgrade the firmware from 7.0.13 B0566 to 7.2.6 B1575:", the FortiOS configuration will be sourced from partition with the original "6.4.6" configuration, not the upgraded "7.0.13" configuration. And since that original FortiOS configuration was not migrated as per approved "Upgrade Path", we would end up with supposedly incorrect FortiOS configuration after the upgrade.

Is the above conclusion correct?

Thanks!

[Renante_Era]

When you upgrade the firmware, it's based on the currently running partition and config.

If it's a physical appliance, then chances are it has multiple partition which you can check using # di sys flash list.

In general, you want to follow the upgrade path to avoid corrupt config. If you back up the full config (admin>Configuration>Backup configuration) then all you need to do is reload the firmware version used in the backup config then restore the backup configuration. 

However, if you only moved one firmware then you can boot into the previous partition.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Selecting-an-alternate-firmware-for-the-ne...

[Toshi_Esumi]

When you upgrade A->B->C in two steps in the process KB is describing, The A-config is saved in the same partition with A-image. Then when you upgrade B->C after manipulating the boot partition in KB, the second A partition won't change but C-image and C-config are stored in the first C partition.
Therefore, when you downgrade/swap the active partitions back to the second A partition, it boots up with A-image + A-config.

Toshi

[AlexFerenX]

Hi Toshi,

my question does not relate to which partition's config is used to boot, but, which is used to migrate - the problem "... since that original FortiOS configuration was not migrated as per approved "Upgrade Path", we would end up with supposedly incorrect FortiOS configuration after the upgrade." My context is upgraded partition "C", not, partition for rollback, "A".

The crux: "(as I understand) the configuration used for FortiOS configuration migration will be sourced from partition with "Active" is "Yes". Since we manually changed the "Active" partition, the upgraded "C" partition's configuration will be migrated from "A" partition's configuration, not "B" which is what we want due to "Upgrade path".

Based on my understanding, the procedure in that KB is flawed - it will only work if configuration in "A" can be migrated to "C", but Fortinet only guarantee configuration migration based on "Upgrade Path" (ie. A->B, then B->C, not A->C).

R's, Alex

[Toshi_Esumi]

When FGT boots up (regardless after upgrade or not), it pulls the config into the memory. So when B->C happens, the upgrade is based on the config (after the conversion) in the momory. Not from the partition in the flash.

Toshi

[AlexFerenX]

> When FGT boots up (regardless after upgrade or not), it pulls the config into the memory. So when B->C happens, the upgrade is based on the config (after the conversion) in the memory. Not from the partition in the flash.

This contradicts "When the FortiGate goes through its upgrade procedure via the WebGUI, it applies the firmware upgrade to the non-active partition and takes the existing configuration on the active partition, upgrades it and assigns it to the non-active partition firmware." (FortiGate Recovery Partition), but, since that's not official Fortinet canon, let's assume he's wrong, and you're right....

How can I see the configuration "in the memory", I'm assuming you're referring to Flash/NVRAM (aka. "startup-configuration", in IOS/NX-OS), different to in RAM (ala. "running-configuration", in IOS/NX-OS) - so I can confirm which configuration is being migrated during the upgrade?

[Toshi_Esumi]

Not completely contradict. The author of the article is just saying, the active/upgraded config (originally from the active partition when it booted up but now in the memory) would be saved in non-active partition when upgrade happens. Then active and non-active partition roles would be swapped.

If you have Cisco experience, their router or switch has "running-config" and "startup-config". The running-config is in memory while the startup-config is in the flash. "show run" shows the running-config and when you change something, it changes only in the running config, until you save it ("write mem" or "copy run start").
Kind of similar for most of routers switches whoever the vendor is, because that's similar to most of computer operations, like a PC.

If you still have some doubt, just test it yourself to confirm.

Toshi

[AlexFerenX]

> Not completely contradict. The author of the article is just saying, the active/upgraded config (originally from the active partition when it booted up but now in the memory) ...

No, not "originally ....". He's literally saying it "takes the existing configuration on the active partition, upgrades it ...", ie. during the upgrade. No mention of "memory" in the whole article.

By the way, FortiOS literally calls these two partitions,... "flash" - ala. "diagnose sys flash list".

Are you able to answer: "How can I see the configuration ..." equivalent of "startup-configuration", not "running-configuration", if system global's "cfg-save" is set to 'manual'?

[Toshi_Esumi]

Unlike Cisco, FGTs always "write mem" every time you make changes and exit from the particular config section in CLI or GUI into the active partition/flash. So "running-config" is same as "startup-config" in the active partition.
But it would never change the config in the non-active partition. That's why "swap-back" to the previous partition works with the old config.

I don't know if any command exist to see the config of the non-active partition's config.

Toshi

[Toshi_Esumi]

On the other hand, during upgrade, the FGT converts the config only in the memory and stores/sets it in the non-active partition where the new image is already loaded in, instead of saving it in the active partition, so that when the partitions were swapped and it booted up, it would come up with the new image with the new config. While the previous active image&config are still there in the new non-active partition.

Toshi