Installing firmware on an individual FortiGate-7000 FPM

Use the following procedure to upgrade the firmware running on an individual FPM. To perform the upgrade, you must enter a command from the primary FIM CLI to allow ELBC communication with the FPM. Then you can just log in to the FPM GUI or CLI and perform the firmware upgrade.

During this procedure, the FPM will not be able to process traffic. However, the other FPMs and the FIMs should continue to operate normally.

After verifying that the FPM is running the right firmware, you must log back into the primary FIM CLI and return the FPM to normal operation.

1. Log in to the primary FIM CLI and enter the following command:

   diagnose load-balance switch set-compatible <slot> enable elbc

   Where <slot> is the number of the slot containing the FPM to be upgraded.

2. Log in to the FPM GUI or CLI using its special port number.

   To upgrade the firmware on the FPM in slot 3 from the GUI:

   1. Connect to the FPM GUI by browsing to https://<SLBC-management-ip>:44303.

   2. Go to System > Firmware and select Browse to select the firmware file to install.

   3. Follow the prompts to select the firmware file, save the configuration, and upload the firmware file to the FPM.

   To upgrade the firmware on an FPM from the CLI using TFTP see Installing FPM firmware from the BIOS after a reboot.

3. After the FPM restarts, verify that the new firmware has been installed.

   You can do this from the FPM GUI dashboard or from the FPM CLI using the get system status command.

4. Use the diagnose sys confsync status | grep in_sy to verify that the configuration has been synchronized. The field in_sync=1 indicates that the configurations of that FIM or FPM is synchronized.

   FIMs and FPMs that are missing or that show in_sync=0 are not synchronized. To synchronize an FIM or FPM that is not synchronized, log into the CLI of the FIM or FPM and restart it using the execute reboot command. If this does not solve the problem, contact Fortinet Support at https://support.fortinet.com.

   If you enter the diagnose sys confsync status | grep in_sy command before the FIM has completely restarted, it will not appear in the command output. As well, the Configuration Sync Monitor will temporarily show that it is not synchronized.

5. Once the FPM is operating normally, log back in to the primary FIM CLI and enter the following command to reset the FPM to normal operation:

   diagnose load-balance switch set-compatible <slot> disable

   Configuration synchronization errors will occur if you do not reset the FPM to normal operation.