FortiAP unit firmware upgrade

There are multiple ways you can upgrade the FortiAP unit firmware:

• You can enable newly discovered FortiAPs to be automatically upgraded to the latest compatible firmware. This happens once after the FortiAP is authorized by the WiFi controller.
• You can enable automatic firmware updates on your FortiGate which checks for patch upgrades for your FortiGates, FortiSwitches, and FortiAPs. If a compatible upgrade is available, FortiGate automatically downloads and installs them at a scheduled time.
• You can manually view and upgrade the FortiAP firmware from the FortiGate unit.

Checking the FortiAP unit firmware version

To view the list of FortiAP units that the FortiGate unit manages, go to WiFi and Switch Controller > Managed FortiAPs. The OS Version column shows the current firmware version running on each AP.

Enabling automatic FortiAP upgrade after authorization

You can enable the automatic federated upgrade of a FortiAP unit upon discovery and authorization by the WiFi controller. When you enable this feature, newly discovered FortiAPs are automatically upgraded to the latest compatible firmware from FortiGuard Distribution Service (FDS).

To enable automatic FortiAP upgrade - GUI:

1. Go to WiFI & Switch Controller > WiFi Settings and enable FortiAP auto firmware provisioning.
2. Click Apply.

3. Connect and authorize a FortiAP.

   The FortiAP will be upgraded to the latest compatible firmware from FDS.

To enable automatic FortiAP upgrade - CLI:

1. Enable firmware-provision-on-authorization via the CLI:

   config wireless-controller setting
     set firmware-provision-on-authorization enable
     set darrp-optimize-schedules "default-darrp-optimize"
   end

2. Connect and authorize a FortiAP.

   The FortiAP will be upgraded to the latest compatible firmware from FDS.

When firmware-provision-on-authorization is enabled, any new FortiAPs that are authorized will automatically have firmware-provision-latest set to once.

Enabling automatic firmware updates

Automatic firmware updates will upgrade your FortiGates, FortiSwitches, and FortiAPs at a scheduled time.

When you enable automatic firmware updates, it upgrades the FortiAP directly to the target version and does not follow an upgrade path. Refer to the Supported Upgrade Path documentation to ensure you follow the proper upgrade path.

To enable automatic firmware updates - GUI:

1. Go to System > Firmware & Registration and click Automatic patch upgrades disabled.
2. Select Enable automatic patch upgrades for vX.X.

3. Select a date and time for when you want to schedule your upgrade.

4. Click OK.

To enable automatic firmware updates - CLI:

Enable automatic firmware upgrade and schedule a day and time to upgrade.

config system fortiguard
  set auto-firmware-upgrade enable
  set auto-firmware-upgrade-day sunday monday tuesday wednesday thursday friday saturday
  set auto-firmware-upgrade-delay 0
  set auto-firmware-upgrade-start-hour 17
  set auto-firmware-upgrade-end-hour 19
end

The auto-upgrade time is scheduled daily, between 5:00 p.m. and 7:00 p.m.

Upgrading FortiAP firmware from the FortiGate unit

You can manually upgrade the FortiAP firmware using either the GUI or the CLI. Only the CLI method can update all FortiAP units at once.

To upgrade FortiAP unit firmware - GUI:

1. Go to WiFi and Switch Controller > Managed FortiAPs.
2. Right-click the FortiAP unit in the list and select Upgrade.
   or
   Click the row of the FortiAP that you want to upgrade, and click Edit. In Firmware, click Upgrade.
3. You can upgrade using FortiGuard, or select Browse and locate the firmware upgrade file.
4. Click Upgrade.
5. When the upgrade process completes, select OK.
   The FortiAP unit restarts.

To upgrade FortiAP unit firmware - CLI:

1. Upload the FortiAP image to the FortiGate unit.

   For example, the Firmware file is FAP_22A_v4.3.0_b0212_fortinet.out and the server IP address is 192.168.0.100.

   execute wireless-controller upload-wtp-image tftp FAP_22A_v4.3.0_b0212_fortinet.out 192.168.0.100

   If your server is FTP, change tftp to ftp, and if necessary add your user name and password at the end of the command.

2. Verify that the image is uploaded:

   execute wireless-controller list-wtp-image

3. Upgrade the FortiAP units:

   exec wireless-controller reset-wtp all

   If you want to upgrade only one FortiAP unit, enter its serial number instead of all.

Upgrading FortiAP firmware from the FortiAP unit

You can connect to a FortiAP unit's internal CLI to update its firmware from a TFTP server on the same network. This method does not require access to the wireless controller.

1. Place the FortiAP firmware image on a TFTP server on your computer.
2. Connect the FortiAP unit to a separate private switch or hub or directly connect to your computer via a cross-over cable.
3. Change your computer IP address to 192.168.1.3.
4. Using SSH, connect to IP address 192.168.1.2.
   This IP address is overwritten if the FortiAP is connected to a DHCP environment. Ensure that the FortiAP unit is in a private network with no DHCP server.
5. Login with the username "admin" and no password.
6. Enter the following command.
   For example, the FortiAP image file name is FAP_22A_v4.3.0_b0212_fortinet.out.

   restore FAP_22A_v4.3.0_b0212_fortinet.out 192.168.1.3