active-passive firmware upgrade

[apex]

Hi All, I wonder if you can help me. I' ve got two Fortigate 110C boxes running in an active-passive cluster. They are on the firmware 3.0 and I' d like to upgrade them to 4.0 MR3. I know that I can' t jump directly from 3.0 to 4.0 MR3 and will have to do it step by step, but I was wondering what is the best way to do it. Do I upgrade the master first and slave will automatically get upgraded? or do I have to break the cluster? And do it separately? How does the process look like? Thanks in advance! A

[ede_pfau]

Hi, and welcome to the forums. Apparently you' re very new to the forums and haven' t read a lot about current firmware versions. So I will help you: stay away from 4.3 for now! There have been a number of serious bugs and inconsistencies reported which have not been fixed yet; employing this release is asking for trouble. Just do a quick search on " 4.3" or " MR 3" . The update process is easy: using the Web GUI, start the upgrade. The cluster itself will organize it in such a way that the least possible downtime will occur. Specifically, - the passive slave will be upgraded first and reboot - the cluster will fail over to the upgraded slave - the passive slave (ex master) will be upgraded and reboot - depending on your settings, one last failover will happen (or not) So actually, you will sit and watch all the time. Please read the Release Notes carefully and follow the recommended path through the intermediate releases. It can' t be bad to check if the config has been converted flawlessly in between upgrades:

 diag debug config-error-log read

[Zyndarius]

Taking the chance. Approximately, how much time does the process take in a cluster composed by 2 Fortigates? 1 Hour maybe? Or more? The amount of time that is going to take is dependent on the Fortigate' s hardware? Thanks in advance for any feedback.

[emnoc]

time is not that long. In a pinch you could do this in 15-30mins or the time it takes to send the firmware and the reboots for A/P member assuming just 2 members. One thing that you will need to do is break the standby away from the cluster ( assign it an ip_address ) so that you can upload the firmware to the standby unit.

[Zyndarius]

But, shouldn' t the master unit upload the new firmware to the stand-by unit?

[emnoc]

Fortinet has a big document on the upgrade process for the hit-less upgrades. IIRC I don' t think they made any changes in the lastest code with the process but review the documentation. It' s very straight forward for hit-less upgrades between master/standby unit(s).

[ede_pfau]

whoa! Don' t get confused by that last post: you don' t have to break the cluster to upgrade, and IMHO you shouldn' t by no means. Maybe in the days of v2.80 code it was wise to do so, but all steps that emnoc described (and as lined out in my first post) are nowadays taken by the upgrade logic automatically . The firmware image is shoved over via the HA link - watch the activity LED on that port. Breaking a cluster involves assigning new IPs to all ports (or cutting all ports but one off), plus rebooting, the slave unit gets new MAC addresses etc. etc. Heavens, let the FGTs do that and don' t interfere. As with every major operation it' s wise to watch the upgrade process - from the console port. Reason is that on the console port you can see certain messages which are not duplicated in syslog or in the SSH console. In very few cases the slave unit didn' t come back on after the upgrade; that was due to corrupted configuration, mismatched upgrade path or such. Of course we had to resort to breaking up the cluster then to avoid downtime. But that were rare occasions, and certainly before v3.00MR3.

[apex]

Thank you guys for your replies, it looks like the whole process is not that complex, of course - if everything goes as planned Do you by any chance know if any other firmware can be used, as Fortinet doesn' t host on their ftp server anything for 110C that is lower than 3.0 MR6 P4, and I have to start the upgrade from 3.0. Shall I use one for FGT_100? 100A? Thank you in advance, A

[ede_pfau]

No, you cannot use a firmware image for a different hardware. A 110C is not a 100A. You can find the images on Fortinet' s ftp server down to v2.80. In the v3.00 folder, everything older than 3.0MR3 is in ' Archives' . The 110C was not included in the Product Matrix of May 2008 but I' ve got a datasheet of it from August 2008. The first FortiOS firmware available for the 110C is 3.00 MR6 patch4, build 673, from October 2008. You simply cannot have any version before that on your machine.

[ede_pfau]

Upgrade path: 3.6.4 brings to directly to 4.0.4. 4.0.4 brings to either to 4.1.10 or 4.2.8 whichever you like better (green/white layout).