FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Anthony_E
Community Manager
Community Manager
Article Id 196014
Description
This article describes individual FIM/FPM firmware upgrade.
1) Manual FIM02 firmware upgrade/downgrade via CLI
2) Manual FPM04 firmware upgrade/downgrade via CLI

7k chassis running on 7000-FortiOS v6.0.4 is used.
For some reason, replace FIM/FPM module in the FortiGate-7040E is needed.

More detail information about module replacement in this link:
https://docs.fortinet.com/document/fortigate-7000/6.0.4/fortigate-7000-handbook/941047/replacing-a-f...

New received FIM/FPM blade arrived with different code version on it (e.g. 7000-FortiOS v6.0.9).
To bring the chassis up and running, be sure that all the blades are running under same firmware version.
Upgrade/downgrade the new received FIM/FPM module.


FortiGate-7040E chassis will be used as an example.
FortiGate-7040E has 2 FIM modules and 2 FPM modules.

Find more detailed information here:
https://docs.fortinet.com/product/fortigate-7000/hardware

After physical replacement new installed blade has to be in Slave status.
Accordingly, upgrade/downgrade steps will be identical for FIM01/FIM02 and FPM03/FPM04.

FIM01 and FPM03 are master blades in this case and non-master FIM02 and FPM04 will be upgraded/downgraded .

Scope
For version 6.0.4.

Solution
Manual FIM02 firmware upgrade/downgrade via CLI.

After physically plugging in new FIM02 blade our current setup looks like this:
---------FPM03-6.0.4---------
----------FIM01-6.0.4---------
----------FIM02-6.0.9---------
---------FPM04-6.0.4---------
Requirement:

1) Firmware file for FortiGate 7k (FGT_7000E-v6-build8405-FORTINET.out).
2) Console connection.
3) TFTP server (e.g. 10.10.0.10/24).
4) Routed management IP address (e.g. 10.20.0.10/24). Different and not used by any other unit.

Keep in mind, that all the operations and commands should be run via console connection.

Preparation:

 - When performing basic health check, FIM02 is not visible in outputs.

FG74E83E10xxxxxx [FIM01] (global) # diagnose load-balance status                    <----- There is no 'Slot: 2'.
==========================================================================
Current slot: 1  Module SN: FIM01E3E11xxxxxx
  FIM01: FIM01E3E11xxxxxx
  Master FPM Blade: slot-3

     Slot  3: FPM20ET013xxxxxx
       Status:Working   Function:Active
       Link:      Base: Up          Fabric: Up 
       Heartbeat: Management: Good   Data: Good 
       Status Message:"Running"
     Slot  4: FPM20ET014xxxxxx
       Status:Working   Function:Active
       Link:      Base: Up          Fabric: Up 
       Heartbeat: Management: Good   Data: Good 
       Status Message:"Running"


FG74E83E10xxxxxx [FIM01] (global) # diagnose sys confsync status                   <----- There’s no 'slot_id=1:2'.
=============================8<=============================
Current slot: 1  Module SN: FIM01E3E11xxxxxx
ELBC: svcgrp_id=1, chassis=1, slot_id=1

zone: self_idx:0, master_idx:0, members:3
FIM01E3E11xxxxxx, Master, uptime=7385.64, priority=1, slot_id=1:1, idx=0, flag=0x0, in_sync=1
FPM20ET013xxxxxx, Slave, uptime=7387.65, priority=19, slot_id=1:3, idx=1, flag=0x64, in_sync=1
        elbc-base-ctrl: state=3(connected), ip=169.254.1.3, last_hb_time=7496.29, hb_nr=35161
FPM20ET014xxxxxx, Slave, uptime=7388.45, priority=20, slot_id=1:4, idx=2, flag=0x64, in_sync=1
        elbc-base-ctrl: state=3(connected), ip=169.254.1.4, last_hb_time=7496.12, hb_nr=35158
=============================>8=============================       
 - Check the current firmware version on Master (also check on FPM03 and FPM04. There are in the same code as Master. If not, bring them to the same version what Master has):
FG74E83E10xxxxxx [FIM01] (global) # get sys status
=============================8<=============================
Version: FortiGate-7040E v6.0.4,build8405,190808 (GA)
...
Serial-Number: FG74E83E10xxxxxx
Module Serial-Number: FIM01E3E11xxxxxx
=============================>8=============================
 - Check firmware version on replaced module ( code version is different than FIM01(Master). To do that, toggle between blades using Ctrl+t, stop on FIM02 blade and press enter:
FG74E83E10xxxxxx [FIM02] # get sys status
=============================8<=============================
Version: FortiGate-7040E v6.0.9,build6783,200331 (GA)

=============================>8=============================
 - Copy FGT_7000E-v6-build8405-FORTINET.out (v6.0.4 image) to the TFTP server's root folder.

 - Be sure, to reach the TFTP server address from the management address (basic switching and routing).

Upgrade process:

1) Connect to the unit using the console connection.
2) Toggle between blades using Ctrl+t, stop on FIM02 blade and press enter.
3) After entering the credentials, check FIM02's firmware version using 'get sys status' command. In this case, it is v6.0.9.
4) Reboot FIM02 module using following commands:
    - # config global
    - # execute reboot (also use 'execute factoryreset'. It will clean all the config in new blade, if there is one, and then will restart it)
5) Press 'Y/y' to accept and reboot:
FG74E83E10xxxxxx [FIM02] (global) # execute reboot
This operation will reboot the system!
Do you want to continue? (y/n)
6) Wait while blade restarts and press any key when it prompts 'Press any key to display configuration menu...' Here's the example:
=============================8<=============================
RAM activation
CPU(00:000306f2 bfebfbff): MP initialization
CPU(01:000306f2 bfebfbff): MP initialization
CPU(02:000306f2 bfebfbff): MP initialization
CPU(03:000306f2 bfebfbff): MP initialization
CPU(04:000306f2 bfebfbff): MP initialization
CPU(05:000306f2 bfebfbff): MP initialization
CPU(06:000306f2 bfebfbff): MP initialization
CPU(07:000306f2 bfebfbff): MP initialization
CPU(08:000306f2 bfebfbff): MP initialization
CPU(09:000306f2 bfebfbff): MP initialization
CPU(0a:000306f2 bfebfbff): MP initialization
CPU(0b:000306f2 bfebfbff): MP initialization
Total RAM: 65536MB
Enabling cache...Done.
Scanning PCI bus...Done.
Allocating PCI resources...Done.
Enabling PCI resources...Done.
Zeroing IRQ settings...Done.
Verifying PIRQ tables...Done.
Boot up, boot device capacity: 15272MB.
Press any key to display configuration menu................................
=============================>8=============================
7) After pressing any key, main configuration menu will appear:
Press any key to display configuration menu.........

[C]:  Configure TFTP parameters.
[R]:  Review TFTP parameters.
[T]:  Initiate TFTP firmware transfer.
[F]:  Format boot device.
[B]:  Boot with backup firmware and set as default.
[I]:  System configuration and information.
[Q]:  Quit menu and continue to boot.
[H]:  Display this list of options.

Enter C,R,T,F,B,I,Q,or H:
8) To configure TFTP parameters press 'C'(no case sensitive):
[P]:  Set image download port.
[D]:  Set DHCP mode.
[I]:  Set local IP address.
[S]:  Set local subnet mask.
[G]:  Set local gateway.
[V]:  Set local VLAN ID.
[T]:  Set remote TFTP server IP address.
[F]:  Set firmware image file name.
[E]:  Reset TFTP parameters to factory defaults.
[R]:  Review TFTP parameters.
[N]:  Diagnose networking (ping).
[Q]:  Quit this menu.
[H]:  Display this list of options.
9) Press 'P' and set one of the MGMT ports (in this case MGMT1 will be used):
 1:     MGMT1
 2:     MGMT2
 3:     MGMT3
 4:     MGMT4
Enter image download port number [MGMT1]: 1 (press 'Enter').

10) DHCP mode is disabled:
 [1]: Enable DHCP
 [2]: Disable DHCP
Enter DHCP setting [Disabled]:(PRESS ENTER)
11) Press 'I' to set local IP address (in this case it is 10.20.0.10):
Enter local IP address [192.168.1.1]:10.20.0.10(press "Enter")
12) Press 'S' to set local subnet mask (in this case it is 255.255.255.0):
Input local subnet mask [255.255.255.0]:255.255.255.0(press "Enter")
13) Press 'G' to set local gateway (in this case it is 10.20.0.1):
Enter local gateway IP address [192.168.1.254]:10.20.0.1(press "Enter")
14) Leave VLAN ID as default(<NULL>):
Enter local VLAN ID (-1 to set it none) [<NULL>]: (PRESS ENTER)
15) Press 'T' to set remote TFTP server IP address (in our case its' 10.10.0.10):
Enter remote TFTP server IP address [192.168.1.100]:10.10.0.10(press "Enter")
16) Press 'F' to set firmware image file name (in this case it is "FGT_7000E-v6-build8405-FORTINET.out"):
Enter firmware file name [image.out]:FGT_7000E-v6-build8405-FORTINET.out (press "Enter")
17) Press 'R' to review TFTP parameters:
Image download port:    MGMT1
DHCP status:            disabled
Local VLAN ID:          none
Local IP address:       10.20.0.10
Local subnet mask:      255.255.255.0
Local gateway:          10.20.0.1
TFTP server IP address: 10.10.0.10
Firmware file name:     FGT_7000E-v6-build8405-FORTINET.out
18) Press 'N' to diagnose network connectivity (that can take few more seconds that in usual):
Enter 1,2,3,Q or H:
[1]:  Ping remote TFTP server.
[2]:  Ping gateway.
[3]:  Ping specified IP address.
[Q]:  Quit the menu.
[H]:  Display the list of opinion.
19) Press '2' to check connectivity with your gateway (press ESC to stop):
Enter 1,2,3,Q or H: 2
Begin to send ICMP packets:
Press ESC to abort ping action.

Reply from 10.20.0.1: time=50ms ttl=255
Reply from 10.20.0.1: time=50ms ttl=255
Reply from 10.20.0.1: time=50ms ttl=255
Reply from 10.20.0.1: time=50ms ttl=255
Reply from 10.20.0.1: time=50ms ttl=255
Successfully receive 5 of out 5 packets from 10.20.0.1.
20) Press '1' to check connectivity with the TFTP server (press ESC to stop):
Enter 1,2,3,Q or H: 1
Begin to send ICMP packets:
Press ESC to abort ping action.

Reply from 10.10.0.10: time=50ms ttl=63
Reply from 10.10.0.10: time=50ms ttl=63
Reply from 10.10.0.10: time=50ms ttl=63
Reply from 10.10.0.10: time=50ms ttl=63
Reply from 10.10.0.10: time=50ms ttl=63
Successfully receive 5 of out 5 packets from 10.10.0.10.
21) Press 'Q' to quit network troubleshooting and go back to TFTP configuration menu:
[P]:  Set image download port.
[D]:  Set DHCP mode.
[I]:  Set local IP address.
[S]:  Set local subnet mask.
[G]:  Set local gateway.
[V]:  Set local VLAN ID.
[T]:  Set remote TFTP server IP address.
[F]:  Set firmware image file name.
[E]:  Reset TFTP parameters to factory defaults.
[R]:  Review TFTP parameters.
[N]:  Diagnose networking (ping).
[Q]:  Quit this menu.
[H]:  Display this list of options.
22) Press 'Q' to quit TFTP configuration menu and go back to main menu:
[C]:  Configure TFTP parameters.
[R]:  Review TFTP parameters.
[T]:  Initiate TFTP firmware transfer.
[F]:  Format boot device.
[B]:  Boot with backup firmware and set as default.
[I]:  System configuration and information.
[Q]:  Quit menu and continue to boot.
[H]:  Display this list of options.
23) Press 'T' to initiate TFTP firmware transfer:
=============================8<=============================
Please connect TFTP server to Ethernet port "MGMT1".
MAC:         90:6C:AC:xx:xx:xx
#####################################################################
Total 72741064 bytes data downloaded.
Verifying the integrity of the firmware image.

Total 262144kB unzipped.
Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]?
=============================>8=============================
24) Press 'D' to set it as a Default firmware and wait until FortiASIC-DP chips will upgrade and the blade will restart:
=============================8<=============================
Programming the boot device now.
............................................................
Reading boot image 2855123 bytes.
Initializing firewall...
System is starting...
DP.0 DDR validation passed
DP.1 DDR validation passed
DP.2 DDR validation passed
old:0x300 0x20190424 --- new:0x300 0x20190226
Update FortiASIC-DP Firmware.
Please don't power off during the update.....!
FortiASIC-DP update: Start process for chip 0
FortiASIC-DP update: Start process for chip 1
FortiASIC-DP update: Start process for chip 2
FortiASIC-DP.0: update file (/data/fpga.7910E.0300.20190226.rbf)
FortiASIC-DP.0:   0% Complete
FortiASIC-DP.2: update file (/data/fpga.7910E.0300.20190226.rbf)
FortiASIC-DP.1:   0% Complete
FortiASIC-DP.1:  10% Complete
FortiASIC-DP.0:  10% Complete
FortiASIC-DP.2:  10% Complete
...
System is starting...
DP.0 DDR validation passed
DP.1 DDR validation passed
DP.2 DDR validation passed
Starting system maintenance...
Scanning /dev/sda2... (100%)
Scanning /dev/sda3... (100%)  


FG74E83E10xxxxxx login:
=============================>8=============================
25) Log in (default credentials 'admin/NO PASSWORD') and performe a health check by using following commands:
 # get sys status
 # diag sys load-balance status
 # diag sys confsync status
The blade still can be out-of-sync, just wait for some time.

26) Go to FIM01 by using Ctrl+t and do the same health check to be sure, that the system is up and running.

Manual FPM04 firmware upgrade/downgrade via CLI.

After physically plugging in new FPM04 blade our current setup looks like this:
---------FPM03-6.0.4---------
----------FIM01-6.0.4---------
----------FIM02-6.0.4---------
---------FPM04-6.0.9---------
Requirement:

1)Firmware file for FortiGate 7k (FGT_7000E-v6-build8405-FORTINET.out).
2) Console connection.
3) TFTP server (e.g. 10.10.0.10/24).
4) Routed management IP address (e.g. 10.20.0.11/24). Different and not used by any other unit.

Keep in mind, that all the operations and commands run via console connection.

Preparation:

- The main difference between FIM and FPM firmware upgrade (over CLI) is due to FPM does not have any physical interfaces, it uses backplane to connect to FIM (it will be configured during TFTP config) and uses one of MGMT ports for network connectivity.
That is why, it is important to configure FIM, to allow FPM use MGMT ports.
This is done by using following command on FIM01(or on FIM02, if you're going to use FIM02):


configure global:
# diagnose load-balance switch set-compatible 4 enable                                   <----- '4' means FPM04. For FPM03 use '3'.
- When performing basic health check, active and running FPM04 will not be visible in outputs.
FG74E83E10xxxxxx [FIM01] (global) # diagnose load-balance status            <----- Slot 4 Status: Dead.
==========================================================================
Slot: 2  Module SN: FIM01E3E12xxxxxx
  FIM02: FIM01E3E12xxxxxx
  Master FPM Blade: slot-3

     Slot  3: FPM20ET013xxxxxx
       Status:Working   Function:Active
       Link:      Base: Up          Fabric: Up 
       Heartbeat: Management: Good   Data: Good 
       Status Message:"Running"
     Slot  4:
       Status:Dead      Function:Active
       Link:      Base: Up          Fabric: Up 
       Heartbeat: Management: Good   Data: Failed
       Status Message:"Waiting for configuration sync."
==========================================================================
Current slot: 1  Module SN: FIM01E3E11xxxxxx
  FIM01: FIM01E3E11xxxxxx
  Master FPM Blade: slot-3

     Slot  3: FPM20ET013xxxxxx
       Status:Working   Function:Active
       Link:      Base: Up          Fabric: Up 
       Heartbeat: Management: Good   Data: Good 
       Status Message:"Running"
     Slot  4:
       Status:Dead      Function:Active
       Link:      Base: Up          Fabric: Up 
       Heartbeat: Management: Good   Data: Failed
       Status Message:"Waiting for configuration sync."


FG74E83E10xxxxxx [FIM01] (global) # diagnose sys confsync status            <----- There is no 'slot_id=1:4'.
=============================8<=============================
Current slot: 1  Module SN: FIM01E3E16000043
ELBC: svcgrp_id=1, chassis=1, slot_id=1

zone: self_idx:0, master_idx:0, members:3
FIM01E3E11xxxxxx, Master, uptime=23282.26, priority=1, slot_id=1:1, idx=0, flag=0x0, in_sync=1
FIM01E3E12xxxxxx, Slave, uptime=11300.20, priority=2, slot_id=1:2, idx=1, flag=0x0, in_sync=1
        elbc-base-ctrl: state=3(connected), ip=169.254.1.16, last_hb_time=23392.81, hb_nr=53848
FPM20ET013xxxxxx, Slave, uptime=23284.66, priority=19, slot_id=1:3, idx=2, flag=0x64, in_sync=1
        elbc-base-ctrl: state=3(connected), ip=169.254.1.3, last_hb_time=23392.87, hb_nr=110895
=============================>8=============================       
 - Check the current firmware version on Master (check on FIM02 and FPM03. There are in the same code as Master. If not, bring them to the same version what Master has):
FG74E83E10xxxxxx [FIM01] (global) # get sys status
=============================8<=============================
Version: FortiGate-7040E v6.0.4,build8405,190808 (GA)
...
Serial-Number: FG74E83E10xxxxxx
Module Serial-Number: FIM01E3E11xxxxxx
=============================>8=============================
 - Check firmware version on replaced module ( code version is different than FIM01(Master)). To do that, toggle between blades using Ctrl+t, stop on FPM04 blade and press enter:
FG74E83E10xxxxxx [FPM04] # get sys status
=============================8<=============================
Version: FortiGate-7040E v6.0.9,build6783,200331 (GA)
...
Serial-Number: FG74E83E10xxxxxx
Module Serial-Number: FIM01E3E14xxxxxx
=============================>8=============================
 - Copy FGT_7000E-v6-build8405-FORTINET.out (v6.0.4 image) to th TFTP server's root folder.

 - Be sure, to reach the TFTP server address from the management address (basic switching and routing).

Upgrade process:

1) Connect to the device using the console connection.
2) Toggle between blades using Ctrl+t, stop on FPM04 blade and press enter.
3) After entering the credentials, check FPM04's firmware version using 'get sys status' command. In this case, it is v6.0.9.
4) Reboot FPM04 module using following commands:
# config global
# execute reboot (also use 'execute factoryreset". It will clean all the config in new blade, if there is one, and then will restart it)
5) Press 'Y/y' to accept and reboot:
FG74E83E10xxxxxx [FPM04] (global) # execute reboot
This operation will reboot the system!
Do you want to continue? (y/n)
6) Wait while blade restarts and press any key when it prompts 'Press any key to display configuration menu...' Here's the example:
=============================8<=============================
RAM activation
CPU(00:000306f2 bfebfbff): MP initialization
CPU(01:000306f2 bfebfbff): MP initialization
CPU(02:000306f2 bfebfbff): MP initialization
CPU(03:000306f2 bfebfbff): MP initialization
CPU(04:000306f2 bfebfbff): MP initialization
CPU(05:000306f2 bfebfbff): MP initialization
CPU(06:000306f2 bfebfbff): MP initialization
CPU(07:000306f2 bfebfbff): MP initialization
CPU(08:000306f2 bfebfbff): MP initialization
CPU(09:000306f2 bfebfbff): MP initialization
CPU(0a:000306f2 bfebfbff): MP initialization
CPU(0b:000306f2 bfebfbff): MP initialization
Total RAM: 65536MB
Enabling cache...Done.
Scanning PCI bus...Done.
Allocating PCI resources...Done.
Enabling PCI resources...Done.
Zeroing IRQ settings...Done.
Verifying PIRQ tables...Done.
Boot up, boot device capacity: 15272MB.
Press any key to display configuration menu................................
=============================>8=============================
7) After pressing any key, main configuration menu will appear:
Press any key to display configuration menu.........

[C]:  Configure TFTP parameters.
[R]:  Review TFTP parameters.
[T]:  Initiate TFTP firmware transfer.
[F]:  Format boot device.
[B]:  Boot with backup firmware and set as default.
[I]:  System configuration and information.
[Q]:  Quit menu and continue to boot.
[H]:  Display this list of options.

Enter C,R,T,F,B,I,Q,or H:
8) To configure TFTP parameters press 'C' (no case sensitive):
[P]:  Set image download port.
[D]:  Set DHCP mode.
[I]:  Set local IP address.
[S]:  Set local subnet mask.
[G]:  Set local gateway.
[V]:  Set local VLAN ID.
[T]:  Set remote TFTP server IP address.
[F]:  Set firmware image file name.
[E]:  Reset TFTP parameters to factory defaults.
[R]:  Review TFTP parameters.
[N]:  Diagnose networking (ping).
[Q]:  Quit this menu.
[H]:  Display this list of options.
9) Press 'P' and set one of the FIM module MGMT ports to use (in this case, FIM01 is used).
 1:     FIM01
 2:     FIM02
Enter image download port number [FIM01]: (PRESS ENTER)
As steps 10 to 26 are identical with FIM firmware upgrade, use the same steps. 
Scroll back the page and follow the instructions from FIM upgrade.


Contributors