Upgrading the deployment

An existing FortiGate Autoscale for Azure deployment can be upgraded in one specific scenario:

It was deployed with the 2.0.9 template.

To determine which template was used in your deployment, refer to the section Determining the FortiGate Autoscale release version.

Read these instructions completely before starting an upgrade.

A deployment with the 2.0.9 template can be upgraded only to the 3.3.2 template. During the upgrade, users can optionally consolidate logging and reporting for the FortiGate cluster by integrating FortiAnalyzer 6.2.5 or FortiAnalyzer 6.4.5.

Prerequisites for upgrading

Linux Operating System
NodeJS 14
Azure CLI
FortiGate Autoscale for Azure upgrade templates

Obtaining the upgrade templates

The FortiGate Autoscale for Azure upgrade templates are located in the Fortinet Autoscale for Azure GitHub project. Navigate to the 2.0.9 upgrade (3.3.2) release and download fortigate-autoscale-azure.zip.

Unzip this file on your local PC. The templates folder will contain these files:

upgrade_fortigate_autoscale_from_2.0.9_to_3.3.2.preparation.json
This template prepares the environment for the upgrade.
upgrade_fortigate_autoscale_from_2.0.9_to_3.3.2.json
This template performs the upgrade from the 2.0.9 template to the 3.3.2 template and pairs with the optional parameter template.
(optional) upgrade_fortigate_autoscale_from_2.0.9_to_3.3.2.params.json
This parameter template pairs with the upgrade template.
upgrade_fortigate_autoscale_from_2.0.9_to_3.3.2.cleanup.json
This template finalizes the upgrade process.

Before you start an upgrade

Upgrading the deployment requires values from the existing 2.0.9 deployment. The following sections describe how to locate these values.

Locating values from the 2.0.9 deployment

Navigate to the Microsoft.Template Overview by following the steps 1-3 of the section Locating deployment Outputs.
On the Overview page, note the value for the parameter Subscription as you will need it for the upgrade.
Click Outputsand note the values for the parameters resourceGroupName and vNetResourceGroupName as you will need them for the upgrade.
Click Inputs.
Make note of values on this page as you will need them for the upgrade.

Upgrade iteration

Upgrade Iteration is an important parameter throughout the entire process. The allowable values for Upgrade Iteration are limited to the numbers 2 thru 9. This value is used to form a unique name for the new resources related to the upgrade. If there are errors during the upgrade, the entire stack can be rolled back - the Upgrade Iteration value is used to remove the resources which were created.

When performing the upgrade for the first time, set Upgrade Iteration to 2. If errors occur, rollback the upgrade and start over with Upgrade Iteration set to 3. Repeat if necessary, increasing the value of Upgrade Iteration each time.

When a deployment is rolled back, the Key Vault will be soft-deleted. Once the Key Vault is permanently deleted, the Upgrade Iteration number can be reused. To permanently delete the Key Vault, open the AzureCLI and run the upgradeIterationCmdDeleteKeyVaultPermanent command from the Outputs of the cleanup template.

Performing the upgrade

The upgrade solution described here is a rollback-capable solution for preparing, creating, and removing resources. The steps below will guide you through the upgrade process.

Before starting an upgrade, ensure that the values for the 2.0.9 template deployment have been located.

Deploy the preparation template as described in the section Deploying the preparation template.
Deploy the upgrade template as described in the section Deploying the upgrade template.
Verify the newly deployed resources. For details, refer to the section Verifying the upgrade deployment.
Do not start the BYOL or PAYG VMSS until you initialize the database. In other words, ensure the instance number of the VMSS is set to 0.
Initialize the database. For details, refer to the section Initializing the database.
Start the two new VMSS. For details, refer to the section Starting a VMSS.
Observe the FortiGate-VMs running in the two VMSS and ensure they are running correctly.
Deploy the cleanup template. For details, refer to the section Deploying the cleanup template.

Deploying the preparation template

Create a template deployment using the preparation template. For details, refer to the section Creating a template deployment . When prompted for parameters, use values as described in the table below:

Parameter display name	2.0.9 template Input	2.0.9 template Ouput	Value to use
Subscription	*	*	Use the value from the 2.0.9 template deployment. Do not change it.
Resource group		resourceGroupName
Resource Name Prefix	resourceNamePrefix
Vnet Resource Group Name		vNetResourceGroupName
Region	*	*	This value cannot be changed. It is tied to the Resource group.
Upgrade Iteration	*	*	Refer to the section Upgrade iteration.

* indicates that there isn’t a value present in the 2.0.9 template Inputs or Outputs.

When deployment of the preparation template has completed, navigate to the Outputs. For details, refer to the section Locating deployment Outputs.
Copy the cmdUpdateAllInOne command.
Open a terminal in your Linux OS.
Log in to your Azure account with the command az login.
Run the command cmdUpdateAllInOne.
Wait for the command to be fully finished.

Deploying the upgrade template

Create a template deployment using the upgrade template. For details, refer to the section Creating a template deployment . For descriptions of the variables, refer to the section Configurable variables. When prompted for parameters, use values as described in the table used when creating a template deployment with the preparation template and from the table below:

Parameter display name	2.0.9 template Input	Value to use
Access Restriction IP Range	accessRestrictionIPRange	Use the value from the 2.0.9 template deployment. May be adjusted to meet the new needs.
Admin Password	adminPassword	Requires manual input. The value from the 2.0.9 template deployment is recommended; a new value may be entered.
Admin Username	adminUsername	Use the value from the 2.0.9 template deployment.
BYOL Instance Count	byolInstanceCount	Use the value from the 2.0.9 template deployment. May be adjusted to meet the new needs.
FOS Version	fosVersion	Use values from the drop-down list. The latest version is recommended.
Forti Analyzer Autoscale Admin Password	*	Follow the instructions in the parameter description.
Forti Analyzer Autoscale Admin Username	*
Forti Analyzer Custom Private IP Address	*
Forti Analyzer Instance Type	*
Forti Analyzer Integration Options	*
Forti Analyzer Version	*
Forti Gate PSK Secret	fortiGatePSKSecret	Requires manual input. The value from the 2.0.9 template deployment is recommended; a new value may be entered.
Heart Beat Delay Allowance	heartBeatDelayAllowance	Use the value from the 2.0.9 template deployment. May be adjusted to meet the new needs.
Heart Beat Interval	heartBeatInterval
Heart Beat Loss Count	heartBeatLossCount
Instance Type	instanceType
Key Vault Name	*	Follow the instructions in the parameter description.
Max BYOL Instance Count	maxBYOLInstanceCount	Use the value from the 2.0.9 template deployment. May be adjusted to meet the new needs.
Max PAYG Instance Count	maxPAYGInstanceCount
Min BYOL Instance Count	minBYOLInstanceCount
Min PAYG Instance Count	minPAYGInstanceCount
PAYG Instance Count	PAYGInstanceCount
Package Res URL	packageResURL	Use the template default value. Do not change it.
Primary Election Timeout	masterElectionTimeout	Use the value from the 2.0.9 template deployment. May be adjusted to meet the new needs.
Scale In Threshold	scaleInThreshold
Scale Out Threshold	scaleOutThreshold
Service Plan Tier	*	Follow the instructions in the parameter description.
Service Principal App ID	restAppID	Use the value from the 2.0.9 template deployment. Do not change it
Service Principal App Secret	restAppSecret
Service Principal Object ID	*	Follow the instructions in the parameter description.
Storage Account Type	storageAccountType	Use the value from the 2.0.9 template deployment. May be adjusted to meet the new needs.
Subnet1Name	subnet1Name	Follow the instructions in the parameter description.
Subnet2Name	subnet2Name
Subnet3Name	subnet3Name
Subnet4Name	subnet4Name
Vnet Address Space	vnetAddressSpace	Use the value from the 2.0.9 template deployment. Do not change it.
Vnet Name	vnetName

If the deployment does not complete successfully, go to the section Troubleshooting the upgrade.

Upload configset files to the Storage account. For details, refer to the section Uploading files to the Storage account.
If you will be using BYOL instances, upload license files to the Storage account.
License files from the 2.0.9 deployment can be reused . However, re-using a license will invalidate the FortiGate which is currently using the license.

Verifying the upgrade deployment

The FortiGate Autoscale for Azure 3.3.2 template will be deployed into the Resource Group and a new set of the following 6 resources will be created:

Function App
App Service plan
Application Insights
Storage account
Azure Cosmos DB account
Virtual machine scale set (BYOL)
Virtual machine scale set (PAYG)

These resources will be created with the same name as the previous 2.0.9 resources with the iteration number appended. For example, if the Upgrade Iteration is 2, the number appended is 002. Verify that they have been created. For details on verifying components, refer to the section Verifying the deployment.

Initializing the database

Do not scale out the BYOL or PAYG VMSS until you initialize the database.

Navigate to the fgt-as-handler function. For details on how to do this, refer to the section To verify the Function App:.
Click Get Function Url to obtain the Function URL:
Open a web browser to run the URL. The expected response is an error as shown below:
Navigate to the cosmos DB account of the current upgrade iteration. For details on how to do this, refer to steps 1 and 2 in the section To verify the database:.
On the right hand side, expand the database FortiGateAutoscale.
Expand the container Settings.
Click on Items.
Confirm that the Settings container has items.

Deploying the cleanup template

Create a template deployment using the cleanup template. For details, refer to the section Creating a template deployment . When prompted for parameters, use values as described in the table below:

Parameter display name	2.0.9 template Input	2.0.9 template Ouput	Value to use
Subscription	*	*	Use the value from the 2.0.9 template deployment. Do not change it.
Resource group		resourceGroupName
Resource Name Prefix	resourceNamePrefix
Vnet Resource Group Name		vNetResourceGroupName
Region	*	*	This value cannot be changed. It is tied to the Resource group.
Upgrade Iteration	*	*	Use the iteration number for the upgrade iteration you want to continue with

* indicates that there isn’t a value present in the 2.0.9 template Inputs or Outputs.

When deployment of the cleanup template has completed, navigate to the Outputs.
Copy the command appropriate for your activity:
- To finalize the upgrade, copy the cleanUpOldComponentCmdDeleteAllInOne command.
- To roll back the upgrade, copy the upgradeIterationCmdDeleteAllInOne command.
Open a terminal in your Linux OS.
Log in to your Azure account with the command az login.
Run the copied command.
Wait for the command to be fully finished.

Troubleshooting the upgrade

As long as an upgrade process isn't finalized, it is regarded as an incomplete upgrade iteration. Reasons for not finalizing can include errors and user intervention.

In the case of an incomplete upgrade iteration, roll back the upgrade iterationand perform the upgrade again with a different value for Upgrade Iteration. It is suggested that the value be increased by 1 with each successive deployment.

Rolling back an incomplete upgrade iteration

Users have the option of rolling back an upgrade iteration by deploying the cleanup template. When deployed, newly created resources related to the upgrade iteration will be released. It is recommended to rollback right away before starting a new upgrade iteration. This option must be used if all the allowable Upgradte Iteration values (2-9) have been used up.

Upgrading the deployment

An existing FortiGate Autoscale for Azure deployment can be upgraded in one specific scenario:

It was deployed with the 2.0.9 template.

To determine which template was used in your deployment, refer to the section Determining the FortiGate Autoscale release version.

Read these instructions completely before starting an upgrade.