HA cluster firmware upgrades

Both management boards and all of the FPCs in a FortiGate 6000F HA cluster run the same firmware image. You upgrade the firmware from the primary FortiGate 6000F management board.

You can perform a graceful firmware upgrade of an FGCP cluster by setting upgrade-mode to uninterruptible and enabling session-pickup. A graceful firmware upgrade only causes minimal traffic interruption. Use the following command to enable these settings; they are disabled by default. These settings are synchronized.

config system ha

set upgrade-mode uninterruptible

set session-pickup enable

end

When these settings are enabled, the primary FortiGate 6000F management board uploads firmware to the secondary FortiGate 6000F management board. The secondary management board uploads the firmware to all of the FPCs in the secondary FortiGate 6000F. Then the management board and all of the FPCs in the secondary FortiGate 6000F upgrade their firmware, reboot, and resynchronize.

Then all traffic fails over to the secondary FortiGate 6000F which becomes the new primary FortiGate 6000F. Then the management board and the FPCs in the new secondary FortiGate 6000F upgrade their firmware and rejoin the cluster. Unless override is enabled, the new primary FortiGate 6000F continues to operate as the primary FortiGate 6000F.

Normally you would want to set upgrade-mode to uninterruptible to minimize traffic interruptions. But upgrade-mode doe not have to be set to uninterruptible. In fact, if a traffic interruption is not going to cause any problems, you can set upgrade-mode to simultaneous so that the firmware upgrade process takes less time.

As well, some firmware upgrades may not support setting upgrade-mode to uninterruptible. Make sure to review the release notes before running a firmware upgrade to verify whether or not setting upgrade-mode to uninterruptible is supported to upgrade to that version.

To make sure a FortiGate 6000F firmware upgrade is successful, before starting the upgrade Fortinet recommends you use health checking to make sure the management board and the FPCs are all synchronized and operating as expected. If you are following a multi-step upgrade path, you should re-do health checking after each upgrade step to make sure all components are synchronized before the next step. You should also perform a final round of health checking after the firmware upgrade process is complete. For recommended health checking commands, see the following Fortinet community article: Technical Tip: FortiGate-6000/7000 Chassis health check commands.