Enabling automatic firmware updates
The auto-firmware-upgrade option can be enabled to automatically update firmware based on the FortiGuard upgrade path. When enabled, the FortiGate will look for an upgrade path and perform an upgrade at a time within the time period specified by the administrator. The upgrade will only be performed on a patch within the same major release version.
When automatic firmware update is enabled, the FortiGate will check for firmware upgrades daily between a configured time interval. When a new patch release is available, a firmware upgrade will be scheduled. By actively searching for patch updates and performing patch upgrades, the system quality is improved as new security fixes are implemented and released.
After the patch release is successfully installed, an email is sent to the FortiCloud account that the FortiGate is registered to.
config system fortiguard
set auto-firmware-upgrade {enable | disable}
set auto-firmware-upgrade-day {sunday monday tuesday wednesday thursday friday saturday}
set auto-firmware-upgrade-delay <integer>
set auto-firmware-upgrade-start-hour <integer>
set auto-firmware-upgrade-end-hour <integer>
end
|
auto-firmware-upgrade {enable | disable} |
Enable/disable automatic patch-level firmware upgrade from FortiGuard. |
|
auto-firmware-upgrade-day {sunday monday tuesday wednesday thursday friday saturday} |
Enter the allowed day or days of the week to start the automatic patch-level firmware upgrade from FortiGuard. |
|
auto-firmware-upgrade-delay <integer> |
Enter the number of days to wait before automatically installing the automatic patch-level firmware upgrade from FortiGuard (default = 3). |
|
auto-firmware-upgrade-start-hour <integer> |
Set the start time of the designated time window for the automatic patch-level firmware upgrade from FortiGuard (in hours, 0 - 23, default = 2). The actual upgrade time is randomly selected in the time window. |
|
auto-firmware-upgrade-end-hour <integer> |
Set the end time of the designated time window for the automatic patch-level firmware upgrade from FortiGuard (in hours, 0 - 23, default = 4). When this value it is smaller than the start time, it will be treated as the same time in the next day. The actual upgrade time is randomly selected in the time window. |
|
The |
Example
The following example demonstrates setting automatic firmware upgrades after a delay of three days.
|
|
To demonstrate the functionality of this feature, this example uses FortiGates that are running and upgrading to fictitious build numbers. |
To configure automatic firmware upgrades:
config system fortiguard
set auto-firmware-upgrade enable
set auto-firmware-upgrade-delay 3
set auto-firmware-upgrade-start-hour 2
set auto-firmware-upgrade-end-hour 4
end
The FortiGate will perform a check between the start and end hours set for the firmware upgrade to review if there is an upgrade available.
To review the available firmware upgrade check schedule:
# diagnose test application forticldd 13
Scheduled push image upgrade: no
Scheduled Config Restore: no
Scheduled Script Restore: no
Automatic image upgrade: Enabled.
Next upgrade check scheduled at (local time) Thu Mar 29 03:10:56 2023
When an available patch upgrade is detected, the automatic firmware update will be scheduled based on the set upgrade delay.
Sample event log after a new patch upgrade is detected:
date=2023-03-29 time=03:10:56 eventtime=1679336380720695924 tz="-0700"
logid="0100032263" type="event" subtype="system" level="notice" vd="vdom1"
logdesc="Automatic firmware upgrade schedule changed" user="system"
msg="System patch-level auto-upgrade new image installation scheduled
between local time Sat Apr 01 03:10:56 2023 and local time Sat Apr 01 04:00:00 2023."
To review the installation window of new patch releases:
# diagnose test application forticldd 13
Scheduled push image upgrade: no
Scheduled Config Restore: no
Scheduled Script Restore: no
Automatic image upgrade: Enabled.
Next upgrade check scheduled at (local time) Mon Mar 30 03:10:56 2023
New image 7.4.1b2305(07004000FIMG0021204001) installation is scheduled to
start at Sat Apr 01 03:10:56:21 2023
end by Sat Apr 01 04:00:00 2023
Once the firmware patch is successfully installed, an event log is created to track the change and an email is sent to the FortiCloud account under which the FortiGate is registered.
Sample event log after successfully updating firmware:
date=2023-04-01 time=03:13:04 devid="FG3H1E5819904039" devname="D" eventtime=1679590383750408029 tz="-0700" logid="0100022094" type="event" subtype="system" level="information" vd="vdom1" logdesc="A federated upgrade was completed by the root FortiGate" msg="Federated upgrade complete" version="7.4.1"