FortiOS 7.4.1 - Automatic Firmware Update

Fortinet is finally working on bringing in some features that are going to make life much easier. For instance, the new FortiGate automatic upgrade feature (that follows the recommended upgrade path!) enabling engineers to keep their fleet up to date easier.
Buy Hardware: bit.ly/2QZVeqh
Get Consulting: bit.ly/36FinSU
My Other Projects:
Office Of The CISO: bit.ly/3HGMH1o
Packet Llama: bit.ly/3SEX3H4
###### SOCIAL LINKS ######
Twitter: bit.ly/2WXiRAv
Facebook: bit.ly/3eigz4D
Instagram: bit.ly/3cZneAz
######################

[@FortinetGuru]

Correction: This feature is not new to 7.4.1! My time away has cost me some knowledge! Thanks for the alert guys! Love Ya'll!

[@adrianren3944]

It's good to see you here again, I really like your videos and they have helped me a lot.

[@nawafXjohn]

this channel is so underrated. Please don't stop making videos

[@MarFox001]

Exactly this! Thanks mike😊

[@Lennypl1]

Nice to have you back, I've always watched your channel and it taught me a lot. Greetings from Poland

[@BlakeOlson1980]

Glad to have you back! I wish we could schedule an upgrade to happen on a date... I don't have a 24x7 operation, but I have a security system that goes offline during an upgrade, so I need to preplan to be offline with the security vendor.

[@serverch]

glad to see you again!

[@RyanOHaganWA]

Glad your back!

[@jw-5654]

Thanks Mike, great to see you back. Looking forward to more of your great content. Cheers from New Zealand.

[@ScubaSteveTXST]

Mike great to see you back, I'm assuming this feature is best for standalone units not being managed by FMG or perhaps the 7.4 FMG would give you a central pane of glass to define it's use. Haven't jumped into 7.4 yet but it's always neat seeing what's on the horizon.

[@jeremy_from_texas]

Glad to see you back Mike! Thanks for another great video!

[@ztech-consulting]

Thank you for the amazing videos 🙏

[@JoeyGarcia]

I read about this, but I think I still rather do it manually. Good to see you back! If you need tips on what topics to discuss... maybe go over a deep dive in all that you can do with diagnose and when to use execute vs get vs diagnose. For instance, how to search your Fortinet stack (i.e., when using FortiLink connected switches) for a particular endpoint MAC address or something. I figured out how to do this, but maybe others could use help.

[@miguelfelipe6]

Glad to have you back Mike

[@MM-ne3mg]

The other time I might hesitate is with HA deployments. I have had, on more than one occasion, the update of an HA pair not complete correctly. I.e. only one updates for some random reason. I like to manually update HA pairs so I can monitor the process from start to finish etc. Cheers ~M

[@FortinetGuru]

Oh lawd. Don’t get me started on HA updates 😂

[@Darkk6969]

I know what you mean. I've never personally experienced this when updating the HA setups including full upgrades. Although I am not running the latest branch firmware either. 7.0 is working for me right now. I do have plans to bump it up to the next version. Just hate moving away from stable versions but eventually will no longer be supported.

[@FortiBytes]

Great to have you back.

[@saifemran4528]

As always, great video! Thanks, Mike!

[@karlkemp5798]

Hi Mike, Could you make a video on the Fortimanager.

[@Darkk6969]

When I upgraded a couple branches to the new firmware I have noticed this new update feature so went ahead and enabled it. I've set it to update itself in 7 days after it's release to give it time to be field tested. I feel 3 days is just too short in case of serious bugs. I get it about zero day CVE these days but friggin annoying to see an office go down and not come back up due to bad update. 7 days is a good balance to me. You're correct that I would never enable this on big production firewalls like at Corporate or Data Centers.

[@hiasiboy90]

Ah yes the friday Yolo feature

[@Citystar1985]

Thx for the video. but the Feature was already released on 7.2.3;)

[@FortinetGuru]

That’s how behind the times I am!

[@Citystar1985]

@@FortinetGuru not true. ;) too much work as everyone

[@e.t3469]

i don't know if you talked about FortiSase but it would be nice if you could.

[@vabello]

Does the automatic update feature read the release notes for known issues and mitigate them or not upgrade if it will cause an impact to the environment? One could dream. :D

[@bennyi.1817]

Is it only the Minor Update that the FortiGate do or the newst Version, for example a Major Update from 7.2.6 to 7.4.1?

[@Darkk6969]

Good question. I can't imagine they would automatically upgrade to the next major version without your consent. Even the installed version is EOL.

[@kd42424]

Thank you for the feature update. You mentioned you probably wouldn't automate a 24Hr production environment. Do you have any general advice on managing say firmware in a 24Hr running environment with one person?

[@FortinetGuru]

I just wouldn’t do automatic on a datacenter. Branches are fine. Big operations you just schedule windows and properly execute change management requirements.

[@MM-ne3mg]

Depending on the deployment, HA might be a good option. It can allow for a seamless update

[@kd42424]

@@MM-ne3mg Interesting you say HA as the main site is in HA. I've applied firmware and lost complete access for about 15 minutes. Even Forticloud showed no connectivity during an update. I was remote assuming HA would be fine. Don't trust it now

[@MM-ne3mg]

​@@kd42424 I hear you. Most of my deployments are HA, it generally does work well. You just need to watch out for some of those gotchas i.e. When updating it appears like you loss connection but really you need to reconnect since the other unit has taken over, ensure cabling setup is confirmed, be aware of what applications may not like the HA handover etc. Don't give up on it, it does work! If you encountered issues just monitor it really closely next time to see what broke during the update or reach out to TAC prior to the update. The support team at Fortinet are fantastic.

[@Darkk6969]

@@MM-ne3mg I have a couple of locations with HA (Corporate and Data Center). They always update without issues and almost zero disruptions. The disruptions are usually very brief and nobody notices it. Whenever I lose connection to the firewall I just refresh the page because the MGT's virtual IP is being moved to the active box. Then I can get back in to monitor the remaining updates on the secondary box.

[@nbctcp3450]

could u pls use mic. ur voice rather soft