fortigate update failed after upgrading to 5.4.4

[kinmun]

i am getting the following update failure error after updating firmware from 5.2.9 to 5.4.4 last night.

my firewall is in HA pair.

Sec-fw02 is the passive unit.

schedule is to update every 3 hrs.

Message meets Alert condition

The following critical firewall event was detected: FortiGate update failed.

date=2017-04-11 time=10:18:17 devname=SEC-FW02 devid=FGT3HD3915801660 logid=0100041001 type=event subtype=system level=critical vd=root logdesc="FortiGate update failed" status=update msg=" Fortigate scheduled update failed" 

[rafiki]

Same problem in v6.0.3 build0200 (GA)

something new here?

Thanks

[anasalomari]

Hello;

Try to ping update the update server update.fortiguard.net ;

then

try to telnet the update server  over 443,

and attached the output;

[rafiki]

anasalomari@hotmail.com wrote:

Hello;

Try to ping update the update server update.fortiguard.net ;

then

try to telnet the update server  over 443,

and attached the output;

Hello,

My Scheduled Updates are set each 2 hours. The update fails sometimes, yesterday 1 time only.

Ping and telnet to the update.fortiguard.net ports works well now.

¿Maybe it could be an update.fortiguard.net connectivity issue?

Best regards

 

[anasalomari]

hello,

do you have IPS,IDS, ... or any security layer in front of your fortigate.

Thanks,

Anas

[rafiki]

anasalomari@hotmail.com wrote:

hello,

do you have IPS,IDS, ... or any security layer in front of your fortigate.

Thanks,

Anas

Yes we do, but most of the time It works well. However, our firewall discards some ICMP traffic, and sometimes ping fails.

Best regards

[Belgarioz]

I don't know if it helps.

We are having a serious issue from 5.4.10 -> 5.6.7

"following fortinet upgrade steps 5.2.10 -> 5.2.12 -> 5.4.10 -> 5.6.7 we decided to upgrade one FGT HA.

The upgrade until 5.4.10 went fine, but when we pushed the 5.4.10 -> 5.6.7 update we had a serious problem: the update has been pushed to the slave (as it should do), but it wasn't pushed to the master. As a result we had a huge packet loss after the slave rebooted. We had to ask the guy who was on site to power off the slave. Then the master went up and was NOT updated (it has 5.4.10). With the SLave still powered off we forced an update to the master. Then we powered on the slave... and everything went fine."

What I noticed is you are having a huge packet loss after the update and it seems to me a situation pretty similar to mine.