Course contents

Module 10: Firmware ManagementLesson 10.1 (1 of 1 in this module)13 of 17 in the FortiManager Administration course

Firmware management and upgrades

FortiGuard firmware images, upgrade paths, scheduling upgrades from FortiManager, and what to check before and after.

Advanced · 20 min read

Written for FortiManager 7.6 · FortiManager 7.4: not yet reviewed

Exam domain: NSE 6 FortiManager (7.6) · Advanced Configuration

Before this: Device status, the device database and revisions

You'll learn to plan a firmware upgrade for many FortiGates, run it from FortiManager and verify the result.

Upgrading fifty firewalls without fifty change windows

Firmware upgrades are one of the main reasons to centralise management. FortiManager can hold firmware images and upgrade many devices on a schedule, with the same pre-checks each time.

One window or fifty
One window or fiftyWithout central upgrade each device needs its own window.By handOne window per deviceHard to trackCentrallyScheduled in groupsTracked in one placevs

On small screens, swipe sideways or focus the diagram and use the arrow keys.

FortiManager can stage and schedule upgrades.
One firmware image, upgraded in waves from FortiManager
One firmware image, upgraded in waves from FortiManagerFortiManager at 10.255.9.10 holds the approved firmware image. It upgrades one pilot FortiGate first, FGT-PILOT. When the pilot checks out, it upgrades wave 1, a small group of branch units, and finally wave 2, the rest of the estate. Each wave is checked before the next starts, so a bad image affects one device and not fifty.FortiManager10.255.9.10Wave 0: pilotFGT-PILOT, 1 unitWave 1: branchesBR-01 to BR-05Wave 2: the restall remaining unitsCheck status and revisions after each wave before starting the next.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

A staged rollout turns fifty change windows into three, with a stopping point after each. Keep the previous image available in case a wave needs to go back.

Before the upgrade

Before the upgrade
Before the upgradeRead notes, back up and check space and health.Release notesreadBackupconfigurationCheckspace and HAPlanorder and window

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Do these for every device.
  1. Read the release notes for your current and target versions, including known issues.
  2. Check the upgrade path and plan any intermediate release.
  3. Back up the FortiGate configuration and keep a FortiManager revision of it.
  4. Check device status: connection up, configuration in sync, no pending installs.
  5. Pick a pilot: one or two low-risk devices go first.

HA clusters and remote sites

Upgrading an HA pair restarts units in turn, and a site with no out-of-band access cannot be recovered remotely if an upgrade goes wrong. Agree who is on site or on the console before you start.

Run it from FortiManager

Select the devices in Device Manager and start the firmware upgrade, choosing the image and a time. FortiManager sends the image, restarts the device and reconnects. Watch the task for each device.

Run the upgrade
Run the upgradeSelect devices, choose the version and schedule.Pilot groupfirstSchedulethe windowUpgradein batchesWatchstatus

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Upgrade a pilot group first.

After the upgrade

After the upgrade
After the upgradeCheck the version, the policy and sync status.Versioncorrect?Statusin sync?Servicestested?Closethe change

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Confirm services work before closing the change.
  • The connection returns to Up and the configuration status to synchronized.
  • Device and policy package status are as expected, and a test flow works.
  • The ADOM version matches the new FortiOS version when all its devices are upgraded.

Check your understanding

Predict · scenario 1

What should you check before upgrading from one release to a much newer one?

Predict · scenario 2

Why start with a pilot device?

Predict · scenario 3

After all devices in an ADOM are upgraded, what should you consider?

Further reading in Fortinet's documentation

Links open the named page in Fortinet's documentation (checked 19 October 2026). RouteLearn is an independent educational resource, not affiliated with or endorsed by Fortinet. Fortinet, FortiGate, FortiOS, FortiManager and FortiGuard are trademarks of Fortinet, Inc. Example output on this page is illustrative.

FAQ

Can I jump straight to the newest release?
Often not. FortiOS has supported upgrade paths with required intermediate releases for some versions. Check the upgrade path tool and release notes for your exact versions before you start.
What about the ADOM version after an upgrade?
The ADOM version must match the FortiOS version of its devices. Plan to move the ADOM to the new version once all its devices are upgraded, or move devices to a matching ADOM.
What if an upgrade fails on one device?
Stop the rollout, keep the device accessible by console or out-of-band, read the upgrade task log and fix the cause before continuing with the rest.