Upgrading Fortigate FW Using Command Line Remotely?

[BusinessUser]

I am able to upload firmware from PC to remote firewall using GUI.

Is it possible to upload firmware from PC to remote firewall using CLI?

My target firewall is using accessed using an external ip address.

However my computer is seated far away at home - and of course using an internal ip.

As such, I cannot set up my comp as a tftp server and get it to ping me.

So is it possible to upgrade firewall at home using CLI? 

I find that using the CLI is better as it enables me to see the error messages but in GUI i dont know what is going on.

Or is there an alternative way for me to download the firmware directly into the firewall instead of the PC? 

[pgautam]

Hi @BusinessUser

Thank you for posting your query.

In order to upgarde FGT using the cli you will need TFTP server.

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/596131/upgrading-the-firmware

You can download firmware from the support portal or user the fortigate GUI option for the firmware upgrade.

Please refere below link for the different type of available firmware upgrade mathod

https://docs.fortinet.com/document/fortigate/7.2.5/administration-guide/596131/upgrading-individual-...

Regards
Priyanka

- Have you found a solution? Then give your helper a "Kudos" and mark the solution

[BusinessUser]

you are not answering the question!

How can i create a pingable tftp server when i am behind a home firewall. 

cant ping from firewall to home pc.

you are not even reading the question!

[pgautam]

Hi @BusinessUser 

I gave you available option detail from the home network without any tunnel connection or TFTP server we will not be able to upload the firmware image on Fortigate.  Yes, you need to be part of the internal network to set up the TFTP server.

Question:- So is it possible to upgrade firewall at home using CLI?
In your case from the home network, we will not be able to upload the image.

Question:- is there an alternative way for me to download the firmware directly into the firewall instead of the PC?
Not directly in the firewall, however, using the USB drive it is possible

https://docs.fortinet.com/document/fortigate/7.2.5/administration-guide/183352/restoring-from-a-usb-...

While upgrading from the USB drive from the SSH connection you can see the cli error you observe. Once the firewall will go in restart you will not be able to see cli.

During the upgrade, it's best to have local access to the firewall if in case you come across any issue during the upgrade it can be reverted.

Before you install any new firmware, follow the below steps:

>> Understand the maturity level of the current and target firmware releases to help you determine whether to upgrade. See Firmware maturity levels.
>> Review the Release Notes for a new firmware release.
>> Review the Supported Upgrade Paths.
>> Download a copy of the currently installed firmware, in case you need to revert to it. See Downloading a firmware image and Downgrading individual device firmware for details.
>> Have a plan in place in case there is a critical failure, such as the FortiGate not coming back online after the update.
>> This could include having console access to the device (Connecting to the CLI), ensuring that your TFTP server is working (Installing firmware from system reboot), and preparing a USB drive (Restoring from a USB drive).

>> Back up the current configuration, including local certificates. The upgrade process prompts you to back up the current configuration. See also Configuration backups for details.
>> Test the new firmware until you are satisfied that it applies to your configuration. See Testing a firmware version and Using controlled upgrades for details.
>> Installing new firmware without reviewing release notes or testing the firmware may result in changes to settings and unexpected issues.

Regards
Priyanka

- Have you found a solution? Then give your helper a "Kudos" and mark the solution

[BusinessUser]

Hi,

This reply is much better. 

Is it possible to enter the url of the firmware in the cli so that the fortigate can auto download?

[pgautam]

Hi @BusinessUser 

To answer your query yes on the FGT URL upgrade option available for the firmware upgrade. 

# execute restore image ?
flash >> Restore image from flash.
ftp >> Load image from FTP server.
management-station Restore image from the Management station.
tftp >> Restore image from TFTP server.
url >> Restore image from URL with HTTP/HTTPS protocols. Decrypt image if needed.
usb  >> Restore image from USB disk.

However, if you observe when we upgrade FortiGate from the GUI method it takes the firmware image from the FDS(Fortiguard server) server.

This is the reason if you have Fortiguard connectivity down you will not be able to update the firmware using the automatic option then manually firmware needs to upload or fix Fortigaurd connectivity issue first.

exec ping service.fortiguard.net

exec ping update.fortiguard.net

exec ping guard.fortinet.net

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Unable-to-connect-to-FortiGuard-serv...

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/596131/upgrading-individual-...

Regards
Priyanka

- Have you found a solution? Then give your helper a "Kudos" and mark the solution

[ede_pfau]

Maybe it's just me, but what is the problem? You can always manage the FGT via GUI _and_ via CLI (ssh) at the same time. Use the GUI to upload the firmware and the CLI to monitor.

Even better would be to monitor the FGT's serial port, as a lot more messages only appear in the Console. I use an inexpensive USB-to-IP terminal server device for this, combined with the serial-to-USB cable provided with newer FGTs.

Of course, if you cripple the remote FGT up to the point where you lose WAN access, the serial connection won't help much. But usually, you'll see a lot more infos. You can even get into the boot menu.

If anybody else is using USB-to-network servers, please share your make and model here, as I am not 100% satisfied with my device (a noname from/via amazon).

[BusinessUser]

hi,

what is USB-to-network servers?

what is USB-to-IP terminal server ?

Is it oob?

I cant go to site as it is in another state so suggestions are appreciated.