FortiGate 101F Upgrade – From FortiOS 7.0.8 to 7.x with BGP Enabled

[Tannu1986]

Hi everyone,

I’m planning to upgrade a FortiGate 101F currently running FortiOS 7.0.8 to a newer 7.x version (likely 7.2 or 7.4).

My client is a bit concerned about the BGP stability after the upgrade, since the FortiGate is currently handling BGP routing.

Before proceeding, I’d like to ask if anyone has already performed this specific upgrade and could share their experience;

• Any issues encountered with BGP sessions, neighbors, or route redistribution after the upgrade.

• Whether you recommend going straight to 7.4.x or stopping at 7.2.x for now.

Any insights, tips, or best practices would be greatly appreciated

Thanks in advance for sharing your experience!

[Toshi_Esumi]

What is your customer's specific concerns about BGP after upgrade?
We don't use much 100/101F but have some with BGP(eBGP) and those went from 7.0.11 or 12 to 7.2.9 or .10 about a year ago. But other models have more BGP and went through the same upgrade paths about the same time. But the main difference in software between models are due to the difference between those ASICs, including NPU. And, routing protocol like BGP is, I believe, handled by CPU (not NPU). So models don't matter.
I don't remember when last time we encounter any BGP related bug for long time, or problem after upgrades, probably because we don't use any tricky BGP features, like ADVPN, etc. But the versions wouldn't make much deference unless FTNT added a new BGP related feature which was not in previous version didn't have. But obviously you wouldn't be using those new features now. We're about to upgrading all of those FGTs to the latest 7.4.x (currently 7.4.9). But BGP would be the last thing to concern.
But if your customer is concerning about issues comes with the upgrade process, which requires a reboot, that's nothing different from a just power-cycling the current FGT.

Toshi 

[Tannu1986]

The client’s main concern is that the BGP might stop working and fail to restart after the update, considering that their firewall is running an older firmware version , which is quite dated.So,Perfect, thank you. I’ll try to convince my client to proceed with the update by explaining that there won’t be any difficulties in carrying out the process.

[Toshi_Esumi · Accepted solution]

BGP is a mature protocol since last century and FGT's coverage is quite mature as well (not about the firmware version with 'M'), which at least we've been using from 4.0 MR3 for last 13-14 years) without any major issue. We might have encountered  some memory issues. But if that's true that would have been very early version like x.x.1-x.x.5 in the major versions. But that won't happen until it keeps running for some time without any issues.
Your customer sounds like worrying that BGP is fragile, it's working by chance. If that's the case, it wouldn't come up even a single power-cycle. If that's the concern, you can offer them reboot it multiple times to confirm it comes up as it was before. 

But the most important point is, keeping running an old firmware is risking their network/org having serious security vulnerabilities. If they need to comply with any security standards, or audits, they would be forced to upgrade it to the latest enough version regardless any other minor issues. You should point that out to them.

Then always keep the original version of firmware image handy as well as the last config backup with the version. Then in the worst case, you can always roll it back to the previous version with a few available methods, which should be in your change control document as a contingency plan, and you can provide it to the customer if necessary. 

Toshi

[Tannu1986]

Thank you for your response.

good day.

Giuseppe