Fortigate HA Firmware Upgrade - Some problems to be expected?

[RolandBaumgaertner72]

Hi,

we have a 400 Cluster in a Data Center (400kms away from our office) with actual 6.0.5 version. We wanted to update for years but since this cluster is so important, we were not allowed to do so.

Now we have the GO and I just would like to know if we can expect any problem in any way? We are also not sure right now to do the update via remote, or traveling and be at the side to perform these 6 updates.

The HA is active-passive and the master has a device priority 200, the slave 100. Usually we restart before upgrading to avoid caching problems. Than we expect from other 200D HA updates that one upgrade at least takes 5-8 mins for both FGs.

Any ideas or suggestions? Can we expect any problem in any way?

Thanks!

[akristof]

Hello,

In general, I don't expect any problems during the upgrade. But it is always better to have console access at least to both devices when doing upgrade on important cluster. Just to save some time in case something will go wrong. You can read release notes for the versions you are going and see if there are any special upgrade information.

Make sure that you follow upgrade path correctly. You will avoid any config problems.

Save the configuration before you start and during all upgrades, in case you need to do some recover.

Feel free to open proactive case with TAC just for standby so you will have faster response time.

Regarding upgrade time, every device is different, I would say that 5-7 minute per device is reasonable to expect. That's around 15 minutes for cluster per version.

[RolandBaumgaertner72]

Hi Adrian,

thanks for your fast information. The console connection is the only reason why we are thinking of being on site. I understand that the only advantage is checking if new OS makes any changes in the actual config and getting the information from the console connection.

The TAC pro active case is an option, again this FG cluster is really critical for the company.

Thanks!

[akristof]

Console connection can be useful to monitoring progress of the upgrade. You will see what's device status in case upgrade will go longer than expected.

Depends on importance, it is better to have someone with console access, just in case. Better safe than sorry. But in general, I do not expect any problems with upgrade, especially if you will follow upgrade path.

[mhe]

If the nodes have been running for a long time, I would restart them before upgrading.

[Toshi_Esumi]

Remote console access to individual units is your life line in case something goes in unexpected way.

Toshi

[parteeksharma]

Hi @RolandBaumgaertner72 

Please verify the HA status and configuration sync before the upgrade in case your FortiGate is in HA cluster.  You can check using below link:

get system status
get system ha status
diag sys ha status
diag sys ha checksum cluster

Please refer to the release notes for the upgrade instructions for any potential upgrade impact (known issue) on your configuration.

Please follow the correct upgrade path, you can check the upgrade path using below link.

https://support.fortinet.com/Download/FirmwareImages.aspx

Please refer the given article and follow the steps to do firmware upgrade.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Manual-firmware-upgrade-by-referring-upgra...

If your FortiGate is in HA cluster, refer the below document for HA cluster firmware upgrade

https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/247944/upgrading-fortigates-in-an-ha-clu...

Regards,
Parteek