Upgrade FortiGates with VDOMS with firmware v7.0.17 build0682 M to 7.4.9.M

[yhpp]

Hello everyone, I am publishing this post because I would like to know if any of you have updated a FortiGate with several VDOMs in use in version 7.0.17 to 7.4.9 or 7.4.x, if anyone has done so and if they had any incompatibility problems, specifically if they have done so with any 81F or 2601F model, I would appreciate your positive comments.

[Toshi_Esumi]

This may not be a "positive" comment you're looking for. But as long as you follow the recommended upgraded path like 7.0.17->7.2.12->7.4.9 you can see at the download page, there shouldn't be any "compatibility problems".

However, config errors (you can see in "diag debug config-error-log read" after each step of upgrade path) could happen during the config conversion, depending on what particular features you're using and how each is configured or has in the config (like certificates you imported in the past). And virtually no two FGTs would have the same error unless they're configured in the same way to do the same things.
You need to check the errors and figure out why they happened after the step of upgrade.

In addition to that, there are some changes that could cause something wouldn't work in the way it worked with previous version, like the 7.2.12/7.4.9 change for SAML certificate checks [https://docs.fortinet.com/document/fortigate/7.2.12/fortios-release-notes/684249/saml-certificate-ve... which requires a change on Entra ID/Goodle IdP side if it's not correctly set up.

It's difficult to prevent these types of upgrade related issues unless you keep checking this community's email every day for last 1 year or so. This community communications have saved us for the SAML change particularly. 
https://community.fortinet.com/t5/Support-Forum/SSL-VPN-Doesn-t-work-after-firmware-update-7-2-12/td...
 
Toshi