Fortigate 60e Latest Firmware
Rosita Westhouse
My suggestion would be to keep calm and have a look first which parts of the config are damaged - if any. Going from v5.4.x directly to v5.4.8 isn't nice as an upgrade may include transformations of parts of the config where e.g. the syntax has changed. These transform routines are included in the firmware image and run automatically.
This would really be detrimental if you skipped from one FortiOS main version to another. Currently, there is v5.2, v5.4, v5.6 and (soon, bleeding edge) v6.0 as the main OS versions. But in my experience skipping a patch release will only affect small parts of the config. It would be wise to first assess the damage before downgrading as this will 100% revert the FGT to factory defaults. If you don't have physical access to the FGT this will be really a showstopper.
Just download the current config (without password a.k.a. as cleartext) and compare that with a diff tool to your backup. Chances are high that only the version comment in the first line and all encrypted strings are different. The latter will still be valid.
Everything with the router so far seems fine except that Wifi is almost unuable. I tried loading the previous *.conf file by putting it onto a USB and doing a auto load on restart. (I tried both CLI and GUI methods, always comes back with the latest config)
I will have physical access tonight, the router is at my home. I have remote access here now but will obviously lose connection if I do a firmware downgrade that will have no config. I''m going to try what you folks have said. Thanks!
Actually, just so I'm clear on this - I'm restoring from the secondary partition and not downloading a fresh copy of v5.4.3 (= build 1111) then restoring my config to that...forgive my beginner comments.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
The reason why you see a difference between the build number installed in your device from the one in the support portal is simply that depending on the Hardware model a specific firmware version will have a specific build version too, this means that in the end they are still the same exact versions only optimized slightly differently for each of the hardware models.
Some of the configuration settings "locations" change depending on the version you upgrade to, meaning that you could be bypassing these changes by jumping directly ahead, which could result in the upgrade to have unforeseeable outcomes.
Upon reviewing our internal build database, I've found that build 6083 is actually a special build not available to the general public. It's likely that our TAC (Technical Assistance Center) team provided this specific build to the original poster as a tailored solution to a bug or issue they were experiencing, especially when a public GA (General Availability) release containing the same fix was not yet available.
After many years of deploying and supporting Cisco PIX/ASA, I'm moving to FortiGate. Simple (hopefully) question - a 40F I recently purchase came with 6.4.x installed, I installed the upgrade to 6.4.12. I see that 6.4 is EOES. In general, what is the community doing with brand new deploys, assuming no interoperability with other releases on other devices is needed? are you deploying the latest and greatest, or taking a conservative approach and deploying an older release. That is, right now, 7.2 vs 7.0? My installs are basic internet traffic out, VPN in. No advanced configurations. Related question - I see that there is always a recommended upgrade path (6.4.12 -> 7.0.11 -> 7.2.4), but you can also do a direct update to 7.2.4 as well. For a *brand new out of box* device, is it safe to do a direct update as opposed to following the upgrade path? I would think so, but .......?? Thanks!
I cannot answer if attempting a direct upgrade from 6.4.12 to 7.2.4 will work or not. My guess is, it will not going through normal upgrade procedures...maybe if you were doing a format flash and install process via TFTP, but why go through all that headache when stepping through 7.0.11 adds another 3-5 minutes to the normal upgrading process.
That being said, you also asked about deploying latest and greatest vs being more conservative. Fortinet now declares their firmware releases as Feature or Mature. In a nutshell, Mature releases will have less problems overall while Feature releases will be more problematic, but offer newer features. Read through the release notes for the version you are wanting to implement to see if there might be anything that might impact your environment as every network is different. Unless there is a specific feature in 7.2 code that you need to take advantage of, my recommendation is to stick with a Mature release of 7.0 code, which right now is 7.0.11
It is advised to stick to the upgrade path to make sure that there are no problems or unforeseen mistakes throughout the upgrade process. The upgrade path is set up to make sure that all required firmware and software updates are made in the proper sequence and that any dependencies or compatibility problems are fixed before going on to the following version.
Following the upgrade path is crucial if you want to keep your system stable, safe, and fully functional. The performance, security, and stability of your network may be impacted by a number of problems if you skip upgrades or don't follow the upgrade process carefully.
It is always recommended updating to the latest branch of software version if your device model is supported, as it would include the recent bug fixes from the previous branches. We would advise you to have a look at the release notes of specific version you are interested to upgrade to make sure you are aware about known issues & issues fixed for the same.
About the direct upgrade, we don't encourage direct upgrades at all. It is always recommended to follow the upgrade path to avoid breaking production config as syntax can change between releases and following the path means it gets handled correctly at each step. A new unit on factory default should be ok to upgrade straight to latest as far as I know but you could always just do a reset on the new firmware to be sure if you like.
We just began the process of setting up 22 new fortigates to replace our old sonicwalls. The first one I have booted up is running 7.2.6 firmware. I have heard fortigate firmware can be buggy so would it make sense to go back to the latest mature release (7.0.13), stick with 7.2.6, or update to the latest, since they are all brand new devices.
You could also try to restore from a previous boot image. If you reboot the foritgate connected to the console port with a serial cable. You will see there is a pre-boot option. From that option I believe there Boot with backup firmware and set as default.
We have 2 fortigate 100EF in an HA cluster that needed to be upgraded (were on 7.0.2) and my boss asked if I wanted to give it a shot. He said it was straightforward and that it does the failover itself and all that. Upgrade path was to be .2 -> .5 -> .7 Well I think I got ahead of myself and somehow set the secondary (f2) to upgrade to .7 while the primary (f1) was rebooting to move to .5. This also briefly took down our sites since both FW were down at the same time (we're an e-commerce company).
So now f1 is on 7.0.5 and is the active primary and f2 is on 7.0.7 but f2 is out of sync and f1 still needs to come up to .7... I'm not a real sysadmin or network guy we don't have one. I tried a couple cli commands I saw online. Recalculate, and there was some force sync command too. Neither helped. I also tried the one to force HA failover to make f2 the primary but that didn't either (my boss thought this might help but I guess I wasn't surprised because the HA cluster is basically just 1 box right now I think).
Part of me thinks if I just do the upgrade to .7 on f1 that maybe they'll sync back up and all will be well. Would just have to eat a site outage again for a few minutes while it reboots? Not ideal I know. Another idea the team had was drop f2 out of the cluster but I think without sending someone to the sever farm to be ready to unplug stuff that we would run into network collisions? Any help or thoughts you guys have is appreciated.
First it would be a good idea to contact a Fortinet Partner with knowhow with that products for the next time, especially if it's for your main business . There are a reason, why network specialist are existing. ;)
as your FortiGates are physical appliances, you can take advantage of a fairly easy roll-back feature:
- (hardware) FortiGates usually have two disk partitions, the active one with current firmware, and a secondary with the previous firmware.
Firmware is a form of microcode or program embedded into hardware devices to help them operate effectively. Hardware like cameras, mobile phones, network cards, optical drives, printers, routers, scanners, and television remotes rely on firmware built into their memory to function smoothly.
c80f0f1006