Unable To Downgrade FGT Firmware

[Ellyas]

Greetings,

Hello team. Currently I am in the midst of downgrading a FGT firmware from the default v5.2.2, Build 642 to v5.0.7, Build 271. Once the downgrading has been done, the FGT is refreshed and I was prompted to log in again.

However once I had logged in, I can see that the firmware was not downgraded to the preferred firmware. I had tried to downgrade again, but still firmware still shows v5.2.2, Build 642 instead of the preferred v5.0.7, Build 271.

Our engineer had suggested to try and downgrade via TFTP. But currently resources for the TFTP method is not available at the moment and might be delayed.

May I know is there any other way to perform the downgrade? Also, way was the downgrade not successful even though there were no error message prompted? Seek your immediate advice.

Thanks & regards,

Ellyas.

[Ellyas]

Greetings,

Hi team. Yes the firmware is correct since it was the same firmware used to downgrade other same newly installed FGT 600C. Currently I am liaising with the engineer to try and load the image from TFTP server.

I will share any other findings here.

Thanks & regards,

Ellyas.

[Ellyas]

Greetings,

Hello team. I was able to downgrade the FGT to the preferred firmware (finally). This was done by TFTP method. Our security engineering team also had highlighted to Fortinet Support team and they mentioned that it is the best option for downgrading/upgrading in case normal GUI method does not work.

Thank you for all your feedback and input on this case, appreciate it.

Thanks & regards,

Ellyas.

[AlexFeren]

Ellyas wrote:
Fortinet Support team .. mentioned that it (TFTP) is the best option for downgrading/upgrading in case normal GUI method does not work.

Seems like it was the only option. Doesn't sound right. Did Fortigate log it as a bug?

[Ellyas]

Greetings,

Hi Alex. Not sure if Fortinet support has log it as a bug or not though. Recently I just received the advice from our security engineer saying that Fortinet support mentioned "TFTP is the best option".

And yeah, in my case here it seems that TFTP is the only option, lol... =)

Nevertheless, since the TFTP method seems to work and I was able to load the required firmware to the box, it's all good here.

Most importantly now I know what to do if similar cases like this happen again in the future.

Thank you team for your input and support. =)

Thanks & regards,

Ellyas.

[ede_pfau]

hi,

this doesn't need to be complicated.

First, please post your hardware model, and the exact filename of the image you are planning to use.

You can downgrade to any version using a USB stick:

1. load the right image file onto the stick. Make a copy with the name "image.out".

2. Copy a matching config file onto the stick. Make a copy with the name "fgt_system.conf".

3. In the GUI, in System > Config > Advanced, check both checkboxes to auto-load the firmware and config files on boot.

4. reboot the FGT

After the reboot check for config errors:

in the CLI, type "diag deb conf read"

and post it here if any.

[emnoc]

Are you 100% sure you have the right image for your model-type? It's common to  incorrectly try to place a non-Wireless image on a wiFi model or even a PoE model

Also have you looked and doing a tftp-upload after a disk reformat?

Also have you tried to look at what's on your disk partions?

(start with )

diag hardware deviceinfo disk

and then

execute disk list

and then a scan

execute disk  scan

I bet your problem is one of the following;

 1: wrong image for the model of unit

 2: wrong calculated checksum

 3: bad partition that needs a reformat

 4: or it's a bug that requires you reformat in order to download

I known with  earlier pre5.0 code the filesystem format is extended type2 vrs now it's extended type3. If your doing a downgrade and are local to the unit, I would just do a interrupted boot , followed by a re-fromat, and then tftp upload.

I would also look at the release notes for the proper download path if any. I wouldn't be surprised if this is a issue from 5.2.x to 5.0.7 but who knows.

let us know what you  find?