My colleagues and I ran into a problem with updating from 4.0.2 (build 099) to 4.0.4MR1p3 (build 194).
We tried to use a USB stick with a 64MB FAT16 partition to upgrade the device and ended up in an inconsistent state.
We filed a support ticket with FortiCare @ 12h30 and were told we' d get a call back shortly.
Eventually, we cleared the boot device by selecting that option in the Console menu, and we tried to reflash using TFTP. This device is terrible at accepting firmwares in a predictable way. We tried with a TFTP server @ 192.168.1.22 with FGT on 192.168.1.188 (default), and 192.168.1.168 (default) on TFTP server and 192.168.1.188. The Console would print out the device MAC address, then the setup light would flash for 5 minutes and the device would reboot and give the message 
Open boot device failedNo error or status messages during the TFTP session at all! I would have expected it to print " Timeout" or something if anything was amiss. By this time, almost 3 hours had gone by since the ticket was filed. It wasn' t until we called up support and waited until we got someone that a tech told us that the TFTP process should show status symbols (####), and should print a question asking if we wanted to make the image the default boot image. This is documented nowhere! The tech had a heavy accent and kept throwing in idiotic suggestions like " Use the web interface to upload the firmware, it' s easy!" To resolve the issue, we had to enter the Console menu, select TFTP image load, and change the default IP address for TFTP server and FGT IP to a 192.168.3.x subnet. You must also use the firmware image name " image.out" , as naming the file anything else on the TFTP server and trying to get the FGT to load it will fail (we tried image2.out for example). So you cannot use the standard suggested IP addresses, but must use the suggested firmware name even though it suggests that you can type in another. What a hack job! Hope this post helps someone avoid all the trouble we went through.
I just did this yesterday and called the file ' FGT_100A.out' . It loaded fine.. Even through 2 switches... Like Troy stated, not all TFTP servers are created equal... 
The problem may have been that your network won' t accept connections on the 192.168.1.x network...
The problem may have been that your network won' t accept connections on the 192.168.1.x network...
Yeah TFTP servers are like pigs, some are more equal than others... 
ORIGINAL: SecureLayers-Eric Yeah TFTP servers are like pigs, some are more equal than others...I have yet to meet a sausage I didn' t like....
