+372 53 888 229info@itabiks.ee

How to upgrade FortiGate firmware safely, step by step

A step-by-step guide to upgrading FortiGate firmware: checking the version, upgrade path, release notes, backup, maintenance window and post-upgrade checks.

4 min

A firewall is the first line of defence for a company network, but only if its firmware is up to date. Upgrading is not difficult, but rushing it can leave the office without internet. The procedure below usually makes the upgrade go smoothly.

Why upgrade

Fortinet regularly publishes security advisories (PSIRT advisories) about vulnerabilities found in FortiOS. Some are critical, and some have already been actively exploited by attackers, particularly flaws in the management interface and SSL VPN. Old firmware means a known hole stays open. Upgrades also fix bugs and bring new features.

Preparation

  1. Check the current version. Dashboard → Status, or get system status in the CLI. Note the exact version and model.
  2. Choose the target version. Fortinet labels versions in the release notes and on the firmware page as Mature (more stable) or Feature (newer features, less field-tested). For production, generally prefer a mature version that includes the security fixes you need.
  3. Use the upgrade path. FortiOS cannot always be upgraded straight from an old version to the newest one. The upgrade path tool on the Fortinet docs and support site shows which intermediate versions to go through. Skipping steps can lose parts of the configuration.
  4. Read the release notes. Pay particular attention to changed and removed features and known issues. For example, in the FortiOS 7.6 branch SSL VPN is being removed and remote access has to move to IPsec IKEv2.
  5. Take a backup. Admin menu top right → Configuration → Backup. Save the file outside the firewall and put the version number and date in the file name.
  6. Check your FortiCare licence. Without valid FortiCare you cannot download firmware.

Upgrading

  • Maintenance window. The upgrade reboots the device, so internet and VPN usually drop for a few minutes. Pick a time when nobody is working and let users know.
  • Be on site or have console access ready. If something goes wrong, the device may not be reachable over the network. A console cable and physical access are the best insurance.
  • Upgrade. System → Firmware & Registration (System → Firmware in older versions): pick the target version from FortiGuard, or upload a file downloaded from the Fortinet support portal. Go through the intermediate versions one at a time and check that the device comes back up after each step.
  • HA cluster. If two FortiGates run as an HA cluster, they are normally upgraded together while traffic fails over to the other unit. Check the cluster state before and after with get system ha status.

Checks after the upgrade

  • Check the version again: get system status.
  • Does the internet work on all networks (LAN, guest, VLANs)?
  • Does the VPN connect, and can remote workers reach what they need?
  • System → FortiGuard: are licences active and signatures updating?
  • Look for errors in the system logs (Log & Report → System Events).
  • Take a fresh backup, now from the new version.

If something is broken and there is no quick fix, you can roll back by loading the previous firmware and then restoring the backup taken before the upgrade.

How often to upgrade

A sensible rhythm is to review firmware roughly once a quarter and plan an upgrade when security fixes have been released for your version. For a critical, actively exploited vulnerability, upgrade straight away rather than next quarter. Following Fortinet's PSIRT advisories helps you hear about these quickly.

When to call a professional

If the device is several versions behind, runs HA or a VPN affected by the new version, or you cannot be on site during the upgrade, it is worth handing the job to a specialist. ITABIKS upgrades FortiGates in a maintenance window and checks the result; see network device setup or call +372 53 888 229.

Was this article helpful?