Which version of FortiOS should be used?

[MichaelHinz]

Fortinet has an article posted about which FortiOS is recommended in comparison to hardware platforms (Technical Tip: Recommended Release for FortiOS - Fortinet Community).  I have been wrecking my brain in trying to better understand what the philosophy is behind the recommendations.  FortiOS 7.0 was released roughly 3 years ago (2021-03-30) and therefore has obviously the most bug fixes in it.  But according to the product life cycle page it will reach the end of it's engineering support by the end of this month (2024-03-30, Fortinet Service & Support).  

FortiOS 7.2 has been on the market for 2 years now (released 2022-03-31).  I am surprised that it takes Fortinet roughly 2 years to finally recommend it's own software for usage.  It almost seems like the only reason why Fortinet considers the recommendation for 7.2 now is because 7.0 has reached its EOES.  

Does anyone know why Fortinet would not potentially recommend versions of the different OS levels?  For instance:

- if you are running 7.0 we recommend 7.0.14

- if you are running 7.2 we recommend 7.2.8

- currently we don't recommend 7.4.x. 

Is it possible that two or more versions of FortiOS exist that are both still under engineering support and get recommended?  Is 2 years "normal" for bugfixes until a release is considered stable/mature? 

Thank you in advance for any insights.

[akumar02]

Hello Michael,

The recommendations are based on the Product as well as the vulnerability patch. 

Few hardware (for example: D-series) cannot go beyond 7.0.x then the recommendation will be based on the latest vulnerability patch and the mature image in 77.0 versions. 
Right now, all 7.4 versions are Feature-release and not mature releases. That's why you do not see it in the recommendations. 

[MichaelHinz · Accepted solution]

Thank you for your reply.  I am aware that certain hardware platforms / generations of firewalls support only up to certain versions of FortiOS.  As you already pointed out some of the "D" series might support only FortiOS up to version 6.0.x and therefore it would make no sense to recommend to use a version 7.0.x code for those.  However my question is for up-to-date firewalls that support the latest available FortiOS versions.  If a Fortigate (lets say the 101F series) supports 7.0.x (3 year old), 7.2.x (2 year old), and 7.4.x (9 month old) then why is it that only FortiOS 7.0.x is recommended?  How much time does it take for Fortinet to actually recommend a version?  It is normal that a .0 or .1 release of software products are considered to be initial releases and should be used with caution but how long should it take to get a stable release?  In the current situation it appears Fortinet does not recommend to use any of the FortiOS versions until they have been out on the market for 2 years.  Or to say it different - customers should not expect to be able to use any new available features until 2 years after they were released.

In a direct message to me I did receive this response regarding when releases are considered mature:

• Typically Recommended Releases are also labeled as 'Mature' releases
• Significant field deployment of 40,000 or more FortiGates that have installed the recommended build.
• No high-severity vulnerabilities that are without mitigating steps or workarounds

These make sense but I see a problem with the 2nd bullet.  Fortinet customers don't want to be "beta testers" and will only deploy stable/mature/recommended version - especially if they support large environments.  This means Fortinet will not see a high adoption rate of new FortiOS versions for a long time which then again results in Fortinet not recommending the implementation because the deployment numbers are not reached.  Maybe this needs to be thought over...