Firmware upgrade of central and remote FGT units

[Cudin]

Hello all, i'm looking for a kind advise... i need to upgrade the firmware of about 20 remote FGT60E connected via vpn ipsec to a FGT100F at the central site.

All units are running 6.2.2 version of firmware and i want to upgrade them to 6.4.8 version, as i don't think the branch 7.x is stable for production yet.

Considering the notable difference between actual-future version of firmware, how would you suggest to proceed?

A) Upgrade of the central firewall then of the remote firewalls

B) The opposite of A)

C) Intermediate upgrade of the central firewall (for ex. 6.2.9) then upgrade of the remote firewalls then final upgrade of the central firewall

Any other method suggested?

Please note that there is no Fortimanager available.

Thanks a lot in advance for your suggestions

[ede_pfau]

the short version: draw a number between 1 and 21 and update this unit. Loop until all are done.

the long version: FortiOS 6.2 and 6.4 are compatible, especially in respect to IPsec VPN. You don't have to fear that the connection will fail just because both units are on different OS versions. Different situation if you're looking at FortiGates and FortiAnalyzer, or Gates and FortiManager.

My experience with v6.2 and v6.4 is that the latter is leaner and smoother, so to say. So, I would upgrade the central hub first, just for stability. As you like...

[Toshi_Esumi]

Situation like this, I tend to upgrade one remote first then wait at least a couple of days to make sure 1) 6.4.x doesn't break anything at the remote environment including memory/CPU usage for daemon processes, and 2) VPN between 6.2.x and 6.4.x works as expected.

Then either work on the head office next or upgrade all other remote locations, which I would be comfortable because I already tested at one location. The head office upgrade is the most important so maybe leave it for the last.

[Cudin]

Perfect, thank you all