On a fortigate 100F how can I update the secondary partition to match the version on the primary?

[kjs-admin]

I am preparing to update our Fortigate 100F and when I run the command >diagnose sys flash list<enter> I see that there are 2 partitions with different versions.

It is my understanding that when an upgrade is initiated the secondary partition will get the upgrade and become the new primary partiton after the upgrade.  My question is:

How can I update the now ... secondary partition ...  so that both partitions have the same version?

Can someone explain to me how the upgrade process works?  If I have to update a couple of versions to get to the desired version and the upgrade always goes to the alternate partition which had the older version.. how does that work?  Or does the version upgrade always upgrade the primary partition?

My concern is what if the primary partition is no longer bootable and the Fortigate reverts to the secondary partition and t is at a earlier version?  I would prefer to upgrade the fortigate then after 3 months upgrade the other partition.   I was able to do this other non-fortigate appliances.

[Toshi_Esumi]

Your understanding is correct. Any FGT upgrade/downgrade always installs the new/old firmware image into the alternative pertition (if partition 1 is active, installs into 2. If 2, into 1).
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-FortiGate-handle-backup-image-when-upg...
So if you upgrade a FGT from like 7.4.1->7.4.2->7.4.3 it goes like:
  Partition1:7.4.1 - Active/Partition2:7.2.x -> P1:7.4.1/P2:7.4.2 - Active -> P1:7.4.3 - Active/P2:7.4.2.

If you want/need to keep the original 7.4.1 image&config after finished upgrading it to 7.4.3, you need to swap the active partition back to Partition1: 
  exe set-next-reboot primary -> exe reboot
before the 2nd step of the upgrades to 7.4.3, so that the final result would be like
  Partition1:7.4.1/Partition2:7.4.3 - Active

My understanding is that even when the current active partition fails to boot up for whatever the reason is, the FGT wouldn't automatically change the active partition to the alternative one to come up with the old image&configuration. If that happens and got stuck, only way to recover is getting in the boot menu and upload the image from a TFTP server into the broken partition after reformatting it. After booting it up, you have to upload a backup config with that version. Or, at that time, the CLI is operational and you can change the active boot partition to boot up with the old image&config.

Toshi

[Toshi_Esumi]

Probably (I hope) "exe reboot" is not necessary after changing the Active partition. Othewise, the subsequent upgrade would use the original (old) config to convert it to the new version, which might not be supported.

Toshi

[yderek]

From what I can see, the command dia sys flash list, is listing out the current firmware and second partition you seeing is the backup firmware which is the version you upgrade from previously , below KB can help you understanding this better 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-FortiGate-handle-backup-image-when-upg...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Selecting-an-alternate-firmware-for-the-ne...

[kjs-admin]

If the alternate partition is at least 2 previous version behind .... how can that partition upgrade directly to the new version?  If we need to upgrade  from 7.2.8 to 7.2.10 to 7.4.5  If you flip flop partitions for upgrades how can those partitions upgrade directly?

If those alternate partitions successfully get upgraded then why not just upgrade directly to the desired destination version.  Does the partitions get formatted and then re-installed with the new version?

[Toshi_Esumi]

My assumption has been the upgrade process converts the RAM loaded config/config file to the new firmware version's, not from the config file from the flash memory/partition. So as long as you're running the intermediate version, it can be upgraded to the next version, then save it to the flash/partition after that.

Toshi

[kjs-admin]

Hello Toshi_Esumi, 

What do you mean by the intermediate version?  What if the version on the alternate partition is very old will the upgrade to the new version fail?

[TE]

so, let's say you have below:
   partition1: 7.4.8 - Active (and running with this version currently)
   partition2: 5.6.2 (alternative) 
Then, when you upgrade this FGT to 7.4.9, the normal upgrade process would load the image into partition2 (alternative) and convert the current running config on RAM initially loaded from partition1 config file to 7.4.9 compatible one then save it to partition2, and change the Active partition from 1 to 2, then boot it up. The result would be:
   partition1: 7.4.8 (alternative)
   partition2: 7.4.9 - Active (and running with this version)

That's why my idea to to change the Active partition from 1 to 2 prior to initiate the upgrade process:
    partition1: 7.4.8 (alternative) (but still running with this version and config)
    partition2: 5.6.2 - Active (but not running with this version)
Then the upgrade process would install the 7.4.9 image to partition1 and convert RAM config (7.4.8 based) then save it into partition1 because it's alternative partition.
The result should be:
    partition1: 7.4.9 - Active (running with this version)
    partition2: 5.6.2 (alternative)

Toshi