Update Firmware in HA

[juan_battaglino]

Hi everyone! I've been asked to update the firmware of two FortiGate 60D connected in high availability. What are the steps I should follow to do that? Should I update the firmware of the master and the backup by separate or by updating the master also updates the backup one?

Thanks in advance

[Toshi_Esumi]

If you do it via GUI, which we regularly do, it would upgrade both; upgrade the backup first, and switch-over then upgrade the other one, and then switch back (or not).

[ede_pfau]

If you run v4.3 or newer you don't have to do anything special. Just upgrade via the WebGUI (which is run by the master FGT). First the slave will be upgraded, then after a failover the ex-master. Depending on your HA settings, the ex-master will failover a second time to become master again.

If you are onsite, I recommend watching the console output (serial connection), first on slave then on ex-master.

Check the config with "diag deb conf read" afterwards.

Of course, you do a backup BEFORE starting, and you have the old/current firmware image at hand, just in case!