Upgrading firmware on HA units
If you are running FortiMail in HA mode (active-passive or config-only HA), follow the below procedures to ensure a smooth upgrade and less interruption to the email traffic.
To upgrade firmware on an active-passive HA pair
1. Back up configuration on both the master and slave units by going to Maintenance > System > Configuration.
2. Upgrade the firmware on the slave unit according to the upgrade path specified in the release notes.
The reboot event of the slave unit will be logged in the master unit’s HA logs. For details, see
“Failover scenario 3: System reboot or reload of the secondary unit”.
3. Upgrade the firmware on the master unit.
The master unit will send a holdoff command to the slave unit so that the slave unit will not take over the master role during the master unit’s reboot. For details, see
“Failover scenario 2: System reboot or reload of the primary unit”.
Optionally, you can manually force a failover to the slave unit before upgrading the master unit. But this will cause some unnecessary data synchronization. Therefore, it is recommended to upgrade the master unit directly during your maintenance window.
4. Verify the traffic flow on the master unit.
To upgrade firmware on a config-only HA cluster
1. Back up configuration on each unit.
2. Upgrade the firmware on the config-slave unit one by one according to the upgrade path specified in the release notes.
3. Lastly, upgrade the firmware on the config-master unit.
4. Verify the traffic flow on the cluster.