Security Update Support After Firmware License Expiration on Fortigate

[Bruce7x2]

Dear Team,

In the article "Prevent firmware upgrade depending on the current firmware license's expiration date" (7.4.2), it states that "In FortiOS 7.4.2 and above, enforcement of an active FortiGate firmware license to allow firmware upgrades has been improved. Enforcement is based on the expiry date of the current firmware license compared to the release date of the first GA release of a major version. For example, for FortiOS 7.4.x firmware upgrades, enforcement is based on the expiry date of the current support contract compared to the release date of FortiOS 7.4.0 GA."

This means the FortiOS license expiration date must be later than the "first GA release" of a major version (e.g., 7.2.0, 7.4.0, 7.6.0, etc.). For instance, if the current FortiOS license expires on February 1, 2025, and the version is 7.2.x, it can be upgraded to 7.4.x because the 7.4.0 GA release date was May 11, 2023. It can also be upgraded to 7.6.x because the 7.4.0 GA release date was July 25, 2024.
Further assuming the 7.8.0 GA release date is May 25, 2025, a system with an expiration date of February 1, 2025, would not be able to upgrade to 7.8.0.

Is my understanding correct?------>First Question

Furthermore, the document "Prevent FortiGates with an expired support contract from upgrading to a major or minor firmware release" (7.4.0) states that "If the FortiGate support contract has expired, you will be unable to upgrade the firmware to a higher major version, such as from FortiOS 7.0 to 8.0, or to a higher minor version, such as from FortiOS 7.4 to 7.6. However, you can upgrade the firmware of a FortiGate with an expired support contract to a higher patch build, such as from FortiOS 7.4.0 to 7.4.1, to allow for security updates."

This means that once I can upgrade to a specific GA release, I can still receive support for minor versions and patch releases even if the firmware license expires later.

Is this understanding correct?---->Second Question

Finally, based on the above assumptions,I can only upgrade to 7.6.x, and the firmware license has expired.

Does this mean that security patches will be available for 7.6.x until the End of Support (EOS) date (2029-01-25)? Or is security patching only supported until the End of Extended Support (EOES) date? --->Third Quesion

Please aid me to clarify the above Question , Thank you.

Regards,

Bruce Liu

[Stephen_G]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Bruce7x2]

Dear Stephen,

Thank you for your reply, and I kindly ask for your assistance in clarifying this issue.

Of course, if there are any official reference documents, please also provide them for my reference.

Regards,

Bruce Liu

[Bruce7x2]

Dear Sir, 

are there any further update?

Bruce

[sw2090]

hm from out of my own experience (we however don't run 7.4 yet but 7.2):

if the firmware upgrade license has expired you cannot upgrade your fimware "ota" (i.e. have your FGT download it from Fortinet and install it) or via FortiManager Firmware template anymore.

You can however still download the firmware manually (as long as there still is images for your model) from support portal if you still have at least one registered device with valid forticare license.

And you can still upgrade it manually via the webinterface then.

Regently also there was a fix for the ssl engine that came ota via fortiguard and did not require a firmware upgrade. However I guess it does require a valid fortiguard utm services license.

[Bruce7x2]

Based on the context below, this is the part that confuses me:

"If the FortiGate support contract has expired, you will be unable to upgrade the firmware to a higher major version, such as from FortiOS 7.0 to 8.0, or to a higher minor version, such as from FortiOS 7.4 to 7.6. However, you can upgrade the firmware of a FortiGate with an expired support contract to a higher patch build, such as from FortiOS 7.4.0 to 7.4.1, to allow for security updates."

Does this mean that if the firmware license has expired, OTA updates are not allowed? That seems a bit unreasonable.

Of course, if this is indeed the case, we would need to further consider whether it's possible to download updates through FortiCare (FortiCloud).

However, what I’m curious about is if my firmware license has expired, would I still have the ability to download firmware/hotfixes via FortiCloud? Or would I need to pay an additional fee to enable FortiCloud downloads for updates?