Unable To Downgrade FGT Firmware

[Ellyas]

Greetings,

Hello team. Currently I am in the midst of downgrading a FGT firmware from the default v5.2.2, Build 642 to v5.0.7, Build 271. Once the downgrading has been done, the FGT is refreshed and I was prompted to log in again.

However once I had logged in, I can see that the firmware was not downgraded to the preferred firmware. I had tried to downgrade again, but still firmware still shows v5.2.2, Build 642 instead of the preferred v5.0.7, Build 271.

Our engineer had suggested to try and downgrade via TFTP. But currently resources for the TFTP method is not available at the moment and might be delayed.

May I know is there any other way to perform the downgrade? Also, way was the downgrade not successful even though there were no error message prompted? Seek your immediate advice.

Thanks & regards,

Ellyas.

[AlexFeren]

Ellyas wrote:
... I am in the midst of downgrading a FGT firmware from the default v5.2.2, Build 642 to v5.0.7, Build 271...

I cannot help with the downgrade, however, would you mind sharing the reason for downgrade - is it functionality, reliability, or security related? [You see, we're in consideration to upgrade from 5.0.x to 5.2.y.]

... currently resources for the TFTP method is not available at the moment and might be delayed.

if your unit has a USB port, try "execute restore image usb ..."?

Also see How to restore previous version of firmware from flash disc via CLI.

[Ellyas]

Greetings,

Hi Alex. We are downgrading to this particular firmware is due to standardization process. When a new FGT is installed, this was the instruction received.

I tried to re-downgrade again today and just noticed the error message as per image named "FGT_01.jpg". I had checked the firmware file and it is indeed for this model and was used successfully to downgrade other FGT with the same model.

Any idea on what are the possible reasons that this error message might appear?

Thanks & regards,

Ellyas.

[AlexFeren]

Since this is a new device..., I'd use CLI to load the firmware as secondary image and see how that goes - "secondary-image usb ...".

PS. verified MD5 of the file?

[Ellyas]

Greetings,

Hi Alex. Is there a way to load the preferred firmware from CLI besides the TFTP method? By the way, how can I load the firmware as secondary? Is the method applicable by GUI or strictly by CLI only?

How can I verify the MD5 checksum?

Thanks & regards,

Ellyas.

[AlexFeren]

Ellyas wrote:
Is there a way to load the preferred firmware from CLI besides the TFTP method?

Yes, USB!

how can I load the firmware as secondary? Is the method applicable by GUI or strictly by CLI only?

Your GUI method is failing, so, I suggest CLI - "execute restore usb ..." or "execute restore secondary-image usb ..."

How can I verify the MD5 checksum?

On Linux, built-in 'md5sum' command, on Windows md5summer.

Again, have a look at Knowledge Base article 'Loading FortiGate firmware image using TFTP'.

[Ellyas]

Greetings,

Hi Alex. A had verified the MD5 checksum is okay. Which means that the firmware file is good to go. I also did download the exact same firmware file from Fortinet support page and re-downgrade it (via GUI) but still failed with the same error (firmware not supported for the device).

In order for me to proceed with either USB or TFTP, basically I need to have physical access to the box correct?

For TFTP method, I would need to wait for the site engineer to set it up. For USB method, I would need to further research on that method and share the info with my engineering team.

Is there any other method or idea to load the firmware besides USB and TFTP?

Thanks & regards,

Ellyas.  

[AlexFeren]

Ellyas wrote:
Is there any other method or idea to load the firmware besides USB and TFTP?

Use ftp: 'image ftp filename server_ipv4[:port]|server_fqdn[:port] [username password]' ??

[YtseJam]

Hi Ellyas,

You can try using FortiExplorer to downgrade or upgrade your firewall firmware version. You can try it if it works for you. Thanks 

[Ellyas]

Greetings,

Hello team. Thank you for all your feedback, and my apologies for the delayed response as I was away during the weekend.

Below is what the result on what had been done so far:

1. Downgrade using GUI (several times).

--> Result: Error message prompted "The given image is not compatible with this hardware".

2. Downgrade using USB stick.

--> Result:

Reading boot image 1379656 bytes. Initializing firewall... System is starting... Get image from USB disk ...     OK. Check image...Check image error.          //Any idea about this error? Get config file from USB disk OK. File check OK.

The firmware file used to downgrade the box is "FGT_600C-v500-build3608-FORTINET.out"

Currently we are working to try and downgrade the box via TFTP server. Not sure whether it will work or not, but hoping for the best.

If you have any other info to share, it will be much appreciated.

Thanks & regards,

Ellyas.