FortiManager Firmware Template real world best practice

[TTFN]

I have an environment with mixed models of FortiGates being managed by FortiManager.

I want to start using FortiManager to handle firmware upgrades rather than manually.

With the templates I can see there seems to be a few options to achieve this and I am looking for best practices in terms of ease of use/reporting etc.

Option 1 - Create a model-firmware template specifically for a specific model and target firmware then with a recurring schedule and assign devices to it as I need to.

Option 2 - Create a firmware template for just a target firmware with a recurring schedule and assign devices as I need to.

Whichever I choose from above, (I am leaning towards Option 1), when a new firmware release is available should I...

Edit the initially created template and add in the new firmware version (And remove the older?)

Create a new firmware template and assign devices to this?

[farhanahmed]

@TTFN 

As you already know there can be different approaches of using Firmware templates.

Use Option 1 by creating model-specific templates to ensure hardware compatibility and granular control. When new firmware is released, edit the existing template to update the target version rather than creating a new one; this prevents configuration bloat and keeps device assignments intact.

[TTFN]

Hi,

Thank you for the reply... my concern with editing the firmware version in the template was that my process with the template would be that I would set it up on a recurring schedule and gradually add devices in...

If I then update the firmware version as all the devices would now all be assigned to the template (to complete the previous upgrade) they would all now upgrade at once (or as many could fit in the window)...

Also does changing the parameters of a template such as unassigning devices or changing firmware remove reports?

[Toshi_Esumi]

I'm not trying to discourage you from utilizing firmware templates. But even with those various nice ways to manage by spending much time to set them up as you want, in reality if you run 10 upgrades for 10 devices at the same time, at least one or two might fail to complete after waiting for 30-40 min, or even 60+ min. Then you have to go back to those failed and figure out why, then run upgrade again only for those.

So we regularly select up to 10 then trigger upgrade from Device Manager screen then choose the version to go to. The rest would be done by FMG automatically other than what to do with those failed ones, which we want to resolve right away. Then repeat this through the rest of our FGTs on the FMG.

Toshi 

[TTFN]

Hi,

Thank you for this...

If I set a recurring schedule then any failed devices would attempt to resolve in the next window?

If you select devices from the device manager screen does this give you scheduling choices etc?

I am not sure I fully understand what you mean when you say the rest would be done by FMG automatically?