Formatting an FPM boot device and installing new firmware

You can use the following steps to format an FPM boot device and install new firmware from a TFTP server. This procedure is based on the procedure Installing FPM firmware from the BIOS after a reboot.

1. Set up a TFTP server and copy the firmware file into the TFTP server default folder.

2. Set up your network to allow traffic between the TFTP server and the MGMT1 or MGMT2 interface of one of the FIMs.

3. Log into the CLI of the FIM.

4. Enter the following command to upload the firmware file from the TFTP server to the FIM:

   execute upload image tftp <firmware-filename> comment <tftp-server-ip-address>

5. Enter the following command to verify that the firmware file has been uploaded to the FIM:

   fnsysctl ls /data2/tftproot/

6. Confirm the internal address of FIM, which is also the address of the FIM's TFTP server:

   fnsysctl ifconfig base-tftp

   Example output:

   base-tftp Link encap:Ethernet HWaddr 06:76:A0:75:E8:F1

   inet addr:169.254.254.1 Bcast:169.254.254.255 Mask:255.255.255.0

   The internal IP addresses of each FIM and FPM is 169.254.254.<slot-number>.

7. Using the console cable supplied with your FortiGate 7000F, connect the SMM Console 1 port on the FortiGate 7000F to the USB port on your management computer.

8. Start a terminal emulation program on the management computer. Use these settings:

   Baud Rate (bps) 9600, Data bits 8, Parity None, Stop bits 1, and Flow Control None.

9. Press Ctrl-T to enter console switch mode.

10. Repeat pressing Ctrl-T until you have connected to the FPM to be updated. Example prompt:
    <Switching to Console: FPM03 (9600)>

11. Optionally log into the FPM's CLI.

12. Reboot the FPM.

    You can do this using the execute reboot command from the FPM's CLI or by pressing the power switch on the FPM front panel.

13. When the FPM starts up, follow the boot process in the terminal session and press any key when prompted to interrupt the boot process.

14. To format the FPM boot disk, press F.

15. Press Y to confirm that you want to erase all data on the boot disk and format it.

    When the formatting is complete the FPM restarts.

16. Follow the boot process in the terminal session, and press any key when prompted to interrupt the boot process.

17. To set up the TFTP configuration, press C.

18. Use the BIOS menu to set the following. Change settings only if required.

    [P]: Set image download port: FIM01 TFTP Server (the FIM that you uploaded the firmware file to).

    [D]: Set DHCP mode: Disabled.

    [I]: Set local IP address: The internal IP address of the FPM. For example, if you are installing firmware on the FPM in slot 5, the local IP address of the FPM in slot 5 is 169.254.254.5.

    [S]: Set local Subnet Mask: 255.255.255.0.

    [G]: Set local gateway: 169.254.254.1.

    [V]: Local VLAN ID: Should be set to <none>. (use -1 to set the Local VLAN ID to <none>.)

    [T]: Set remote TFTP server IP address: The internal IP address of the FIM that you uploaded to the firmware file to. For example: 169.254.254.1 for the FIM in slot 1.

    [F]: Set firmware image file name: The name of the firmware file that you want to install.

19. To quit this menu, press Q.

20. To review the configuration, press R.

    To make corrections, press C and make the changes as required. When the configuration is correct proceed to the next step.

21. To start the TFTP transfer, press T.

    The firmware image is uploaded from the TFTP server of the FIM and installed on the FPM. The FPM then restarts with its configuration reset to factory defaults. After restarting, the FPM configuration is synchronized to match the configuration of the primary FPM. The FPM restarts again and can start processing traffic.

22. Once the FPM restarts, verify that the correct firmware is installed.

    You can do this from the FPM GUI dashboard or from the FPM CLI using the get system status command.

23. Enter the diagnose sys confsync status | grep in_sy command to verify that the configuration has been synchronized. The field in_sync=1 indicates that the configurations of the FIMs and FPMs are synchronized.

    FIMs and FPMs that are missing or that show in_sync=0 are not synchronized. To synchronize an FIM or FPM that is not synchronized, log into the CLI of the FIM or FPM and restart it using the execute reboot command . If this does not solve the problem, contact Fortinet Support at https://support.fortinet.com.

    If you enter the diagnose sys confsync status | grep in_sy command before the FPM has restarted, it will not appear in the command output. As well, the Configuration Sync Monitor will temporarily show that it is not synchronized.