Update firmware from cli tftp: error code -39

[luca1994]

Hello team,

I have a need to update my fortigate (VM on vSphere) firewall via cli. SO, I installed tftp on a windows server machine and assigned it an ip address in the same network as port2 of my fortigate.
From CLI the ping to tftp server work fine but then the transfer failed with error -39

FortiFirewall-VM64 # execute restore image tftp FGT_VM64_VMX-v7.2.5.F-build1517- FORTINET.out 192.168.X.X
This operation will replace the current firmware version!
Do you want to continue? (y/n)y

Please wait...

Connect to tftp server 192.168.x.x...
Transfer timed out.
Can not get image from tftp server via vdom root.
Command fail. Return code -39

FortiFirewall-VM64 # execute ping 192.168.X.X
PING 192.168.X.X (192.168.X.X): 56 data bytes
64 bytes from 192.168.X.X: icmp_seq=0 ttl=128 time=0.9 ms
64 bytes from 192.168.X.X: icmp_seq=1 ttl=128 time=0.7 ms

any suggestion?

Thanks for the support

BR

[AEK]

Hi Luca

Do you mean the licence has been migrated from VMware's FG VM to HyperV FG VM? If so, you need to download the license file again and push it to your new FG VM. This should work like that.

[luca1994]

Hello @AEK ,

the license has not yet been migrated from Hyper-V to VMWare (not the other way around). Once the license is migrated I need to re-download it and add it to the "new" firewall in VMWare. I will have to do this via cli since with the "new" firewall in VMWare, being in an "unlicensed" state, I cannot access it via GUI but only via VMWare console.
Once this is done the firewall should be back up and running if I understand correctly.

Luca

[AEK]

Yes it should work like that.

However your new FG VM should be accessible via GUI and it should show you at least a message that it is not licensed and asks you to enter a valid license key.

So what do you see when you access via http/https?

[luca1994]

It is not reachable via https or even via ssh even though the services are active on the network card and the 'interface responds to ping and I see all the command line configuration correctly. I will have to try migrating again to see if the problem persists.
At this point I think the access problem is not because the license is missing but because of some error in 'importing the confiugation.

Luca

[luca1994]

Hello @AEK,

I had a chance to retry migrating the firewall from Hyper-V to VMWare. Now I have successfully imported the conf but I can't access it via ssh, http or https. Pinging does work, however.

Below is the network interface configuration

Below is ping and telnet from a Windows machine on the same network segment 192.168.105.x/24

any suggestions?

Thank you very much

[AEK]

Hi Luca

Can you share the following:

diagnose debug config-error-log read

show firewall local-in-pol

config system global

  get admin-port

  get admin-sport

  set admin-server-cert self-sign

Then try sniff the traffic while connecting via https:

diag sniffer packet any 'host x.x.x.x' 4

Where x.x.x.x is your clients IP.