Installing firmware
You can use either the GUI or the CLI to upgrade or downgrade the firmware of the FortiMail unit.
|
Only the super admin account with the "super_admin_prof" access profile can perform firmware upgrades/downgrades through the GUI. |
Firmware changes are either:
- an upgrade to a newer version
- a downgrade to an earlier version
To determine if you are upgrading or reverting your firmware image, examine the firmware version number. For example, if your current firmware version is FortiMail-400 3.00,build288,080327, changing to FortiMail-400 3.00,build266,071209, an earlier build number and date, indicates that you are reverting.
|
Reverting to an earlier version may cause the FortiMail unit to remove parts of the configuration that are not valid for that earlier version. In some cases, you may lose all mail data and configurations. |
No matter if you are upgrading or downgrading, it is always a good practice to back up the configuration and mail data.
To install firmware using the GUI
- Log in to the Fortinet Technical Support web site, https://support.fortinet.com/.
- Download the firmware image file to your management computer.
- Log in to the GUI as the super admin.
- In the advanced mode of the GUI, install firmware in one of two ways:
- Go to Dashboard > Status, and in the System Information area, in the Firmware version row, click Update. Click Browse to locate the firmware and then click Submit.
- Go to System > Maintenance > Configuration, under Restore Firmware, check Local PC, and click Browse to locate the firmware. Then click Restore.
Your web browser uploads the firmware file to the FortiMail unit. The FortiMail unit installs the firmware and restarts. Time required varies by the size of the file and the speed of your network connection.
If you are downgrading the firmware to a previous version, the FortiMail unit reverts the configuration to default values for that version of the firmware. You must either reconfigure the FortiMail unit or restore the configuration file.
To install firmware using the CLI
- Log in to the Fortinet Technical Support web site, https://support.fortinet.com/.
- Download the firmware image file to your management computer.
- Connect your management computer to the FortiMail console port using a RJ-45 to DB-9 serial cable or a null-modem cable.
- Initiate a connection from your management computer to the CLI of the FortiMail unit, and log in as the
adminadministrator, or an administrator account that has system configuration read and write privileges. - Connect port1 of the FortiMail unit directly or to the same subnet as a TFTP server.
- Copy the new firmware image file to the root directory of the TFTP server.
- Verify that the TFTP server is currently running, and that the FortiMail unit can reach the TFTP server.
- Enter the following command to download the firmware image from the TFTP server to the FortiMail unit:
- Type
y. - If you also use the GUI, clear the cache of your web browser and restart it to ensure that it reloads the GUI and correctly displays all tab, button, and other changes.
- To verify that the firmware was successfully installed, log in to the CLI and type:
- If you have downgraded the firmware version, reconnect to the FortiMail unit using its default IP address for port1, 192.168.1.99, and restore the configuration file. For details, see Reconnecting to the FortiMail unit and Restoring the configuration.
- Update the FortiGuard Antivirus definitions.
To use the FortiMail CLI to verify connectivity, enter the following command:
execute ping 192.168.1.168
where 192.168.1.168 is the IP address of the TFTP server.
execute restore image tftp <name_str> <tftp_ipv4>
where <name_str> is the name of the firmware image file and <tftp_ipv4> is the IP address of the TFTP server. For example, if the firmware image file name is image.out and the IP address of the TFTP server is 192.168.1.168, enter:
execute restore image tftp image.out 192.168.1.168
One of the following message appears:
This operation will replace the current firmware version!
Do you want to continue? (y/n)
or:
Get image from tftp server OK.
Check image OK.
This operation will downgrade the current firmware version!
Do you want to continue? (y/n)
The FortiMail unit downloads the firmware image file from the TFTP server. The FortiMail unit installs the firmware and restarts. Time required varies by the size of the file and the speed of your network connection.
If you are downgrading the firmware to a previous version, the FortiMail unit reverts the configuration to default values for that version of the firmware. You must either reconfigure the FortiMail unit or restore the configuration file.
get system status
If you have upgraded the firmware version, to verify the conversion of the configuration file, see Verifying the configuration. If the upgrade is unsuccessful, you can downgrade the firmware to a previous version.
|
|
Installing firmware replaces the current antivirus definitions with those included with the firmware release that you are installing. After you install the new firmware, make sure that your FortiGuard Antivirus definitions are up-to-date. |
See also
Reconnecting to the FortiMail unit
Reconnecting to the FortiMail unit
After downgrading to a previous firmware version, the FortiMail unit reverts to default settings for the installed firmware version, including the IP addresses of network interfaces through which you connect to the FortiMail GUI and/or CLI.
Use either of the following procedures if the FortiMail unit has been reset to a default configuration and you need to reconnect to the GUI.
|
|
If your FortiMail unit has not been reset to its default configuration, but you cannot connect to the GUI or CLI, you can restore the firmware, resetting the FortiMail unit to its default configuration in order to reconnect using the default network interface IP address. For more information, see Clean installing firmware. |
To reconnect using the LCD panel
|
|
This procedure requires a FortiMail model whose hardware includes a front LCD panel. |
- Press Enter to display the Main Menu.
- Press Enter to display the interface list.
- Use the up or down arrows to highlight the network interface that is connected to your management computer, and press Enter.
- Press Enter for IP Address.
- Use the up and down arrows to increase or decrease each number of each IP address digit. Press Enter to go to the next IP address digit or press Esc to move to the previous digit.
- After selecting the last IP address digit, press Enter to save the IP address.
- Repeat steps Press Enter for IP Address.4 to Reconnecting to the FortiMail unit6 to enter the netmask address for the network interface.
- After selecting the last netmask address digit, press Enter to save the netmask address.
- Press Esc to return to the Main Menu.
The network interface’s IP address and netmask is saved. You can now reconnect to either the GUI or CLI through that network interface using. For information on restoring the configuration, see Restoring the configuration.
To reconnect using the CLI
- Connect your management computer to the FortiMail console port using a RJ-45 to DB-9 serial cable or a null-modem cable.
- Start HyperTerminal, enter a name for the connection and click OK.
- Configure HyperTerminal to connect directly to the communications (COM) port on your computer and click OK.
- Select the following port settings and click OK:
- Press Enter to connect to the FortiMail CLI.
- Type
adminand press Enter twice. - Enter the following command:
|
Bits per second |
9600 |
|
Data bits |
8 |
|
Parity |
None |
|
Stop bits |
1 |
|
Flow control |
None |
The login prompt appears.
The following prompt appears:
Welcome!
config system interface
edit <interface_str>
set ip <ip&netmask>
end
where:
<interface_str>is the name of the network interface, such asport1<ip$netmask>is the IP address/netmask of the network interface, such as 192.168.1.10/24
config system interface
edit <interface_str>
set allowaccess {https | http | ssh | snmp | ping | telnet}
end
The network interface’s IP address and netmask is saved. You can now reconnect to either the GUI or CLI through that network interface. For information on restoring the configuration, see Restoring the configuration.
See also
Restoring the configuration
After upgrading or downgrading, you may need to restore a backup copy of the configuration file from your local PC using either the GUI or CLI.
If you have just downgraded or restored the firmware of the FortiMail unit, restoring the configuration file can be used to reconfigure the FortiMail unit from its default settings.
You can also migrate the configuration from one unit to another same or higher model unit, as long as they run the same firmware version.
To restore the configuration file using the GUI
- Clear your browser’s cache. If your browser is currently displaying the GUI, also refresh the page.
- Log in to the GUI.
- In the advanced management mode, go to System > Maintenance > Configuration.
- Click Restore Configuration to locate and select the configuration file that you want to restore, then click Restore.
- After restoring the configuration file, verify that the settings have been successfully loaded. For details on verifying the configuration restoration, see Verifying the configuration.
The FortiMail unit restores the configuration file and reboots. Time required varies by the size of the file and the speed of your network connection.
To restore the configuration file using the CLI
|
|
The following procedure restores only the core configuration file, which does not include items such as the Bayesian databases, dictionary database, and other items. To restore backups of those items, use the GUI. |
- Initiate a connection from your management computer to the CLI of the FortiMail unit, and log in as the
adminadministrator, or an administrator account that has system configuration read and write privileges. - Connect a network interface of the FortiMail unit directly or to the same subnet as a TFTP server.
- Copy the new firmware image file to the root directory of the TFTP server.
- Verify that the TFTP server is currently running, and that the FortiMail unit can reach the TFTP server.
- Enter the following command:
- Enter
y. - After restoring the configuration file, verify that the settings have been successfully loaded. For details on verifying the configuration restoration, see Verifying the configuration.
To use the FortiMail CLI to verify connectivity, enter the following command:
execute ping 192.168.1.168
where 192.168.1.168 is the IP address of the TFTP server.
execute restore config tftp <file_name> <tftp_ipv4>
The following message appears:
This operation will overwrite the current settings!
(The current admin password will be preserved.)
Do you want to continue? (y/n)
The FortiMail unit restores the configuration file and reboots. Time required varies by the size of the file and the speed of your network connection.
See also
Verifying the configuration
After installing a new firmware file, you should verify that the configuration has been successfully converted to the format required by the new firmware and that no configuration data has been lost.
In addition to verifying successful conversion, verifying the configuration also provides familiarity with new and changed features.
To verify the configuration upgrade
- Clear your browser’s cache.
- Log in to the GUI using the
adminadministrator account. - Review the configuration and compare it with your configuration backup to verify that the configuration has been correctly converted.
Other administrator accounts may not have sufficient privileges to completely review the configuration.
See also