Updating Fortigate Firewalls that are in HA

[Kenny915]

I would like to know if it is possible to update the Firewall firmware of 2 Firewalls that are configured in HA in a way different from the current best practices.  What the customer I am working with would like to do is update them as 2 separate firewalls instead of the current configuration that has them basically update at the same time.  I believe this is wanted to combat a bad update being applied to both firewalls.  Is the only option for an HA solution to have the primary download the Firmware to both devices and apply it all in one go or is there a way to do it as 2 independent updates?  

[funkylicious]

Updating firewalls in HA doesnt work like that, meaning it doesnt update them both at the same time in order to have any semnificant downtime.

First the standby/backup member is updated then after it goes back online the primary/master member is updated and fails over to the newly upgrade one, so the downtime would be minimal.

[Kenny915]

Thanks for the Reply, Maybe I wasn't clear but the way I understand it is the customer doesn't like that fact that both take the new Firmware within the same update cycle and would like 1 to be on a previous firmware for a bit to confirm no known issues with the updated firewall. 

[Toshi_Esumi]

To do that, you have to isolate the secondary unit(s) by shutting down HA connection and in/out interfaces on the switch side. That would make the primary as standalone. Then after you/customer is satisfied with the new version, you can upgrade the secondary and recover the HA sync. To do that, you have to have a dedicated outband management interface to get access to the secondary while it's isolated.

But do you know the fact that all chassis based FGTs retain the previous version of image and config in the backup partition? So if something doesn't work well with the new version you can always swap the boot partition to go back to the previous environment.
I would rather persuade the customer and yourself not to add unnecessary complication for the upgrade process, which might cause some trouble since you break and re-sync them later. Or at least you need two maintenance windows instead of one.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Selecting-an-alternate-firmware-for-the-ne...

In case the worst case senario, you can always flush the drive and load up the previous image via TFTP and upload the backup config to recover the original state.

Toshi
 

[dingjerry_FTNT]

Hi @Kenny915 ,

In that scenario, it means your customer has to break the HA so they will have no HA protection before both HA cluster members upgrade to the same version and are in sync.

[Kenny915]

I appreciate the replies, and what you all have stated confirmed my thoughts.  Do to this they currently have the 2 Firewalls not connected so that the HA link is broke.  If I could build on my question is there a way to set them up with an architecture be it physical or not that would put in place redundancy even without using the build in HA capabilities?  This is for critical OT devices and the customer is completely against updating both at the same time even with the roll back capabilities.  This would also need to not be a manual failover it would need to automatically cut over incase of failure. 

[Toshi_Esumi]

If you make FGTs separated for full-redundancy, you need to have at least two internet circuits and let each FGT have each. But you need to have something terminate both and use routing protocol for failover, then it would connect to to the LAN side. But that device or devices need to be redundant or in HA because this is critical, right? Then that device would carry the same issue over from the FGTs. You/they need to trust something at the end of the day.

Toshi