Your new FortiWeb appliance comes with the latest operating system (firmware) when shipped. However, if a new version has been released since your appliance was shipped, you should install it before you continue the installation.
Fortinet periodically releases FortiWeb firmware updates to include enhancements and address issues. After you register your FortiWeb appliance, FortiWeb firmware is available for download at:
Installing new firmware can overwrite attack signature packages using the versions of the packages that were current at the time that the firmware image was built. To avoid repeat updates, update the firmware before updating your FortiGuard packages.
New firmware can also introduce new features which you must configure for the first time.
For late-breaking information specific to the firmware release version, see the Release Notes available with that release.
|
|
In addition to major releases that contain new features, Fortinet releases patch releases that resolve specific issues without containing new features and/or changes to existing features. It is recommended to download and install patch releases as soon as they are available. |
|
|
Before you can download firmware updates for your FortiWeb appliance, you must first register your FortiWeb appliance with Fortinet Technical Support. For details, go to https://support.fortinet.com/ or contact Fortinet Technical Support. |
You can test a new firmware image by temporarily running it from memory, without saving it to disk. By keeping your existing firmware on disk, if the evaluation fails, you do not have to re-install your previous firmware. Instead, you can quickly revert to your existing firmware by simply rebooting the FortiWeb appliance.
1. Download the firmware file from the Fortinet Technical Support web site:
2. Connect your management computer to the FortiWeb console port using a RJ-45-to-DB-9 serial cable or a null-modem cable.
3. Initiate a connection from your management computer to the CLI of the FortiWeb appliance.
For details, see Connecting to the web UI or CLI.
4. Connect port1 of the FortiWeb appliance directly or to the same subnet as a TFTP server.
5. Copy the new firmware image file to the root directory of the TFTP server.
6. If necessary, start your TFTP server. (If you do not have one, you can temporarily install and run one such as tftpd (Windows, Mac OS X, or Linux) on your management computer.)
|
Because TFTP is not secure, and because it does not support authentication and could allow anyone to have read and write access, you should only run it on trusted administrator-only networks, never on computers directly connected to the Internet. If possible, immediately turn off tftpd off when you are done. |
7. Verify that the TFTP server is currently running, and that the FortiWeb appliance can reach the TFTP server.
To use the FortiWeb CLI to verify connectivity, enter the following command:
execute ping 192.168.1.168
where 192.168.1.168 is the IP address of the TFTP server.
8. Enter the following command to restart the FortiWeb appliance:
execute reboot
9. As the FortiWeb appliances starts, a series of system startup messages appear.
Press any key to display configuration menu........
10. Immediately press a key to interrupt the system startup.
|
|
You have only three seconds to press a key. If you do not press a key soon enough, the FortiWeb appliance reboots and you must log in and repeat the execute reboot command. |
If you successfully interrupt the startup process, the following messages appears:
[G]: Get firmware image from TFTP server.
[F]: Format boot device.
[B]: Boot with backup firmware and set as default.
[Q]: Quit menu and continue to boot with default firmware.
[H]: Display this list of options.
Enter G,F,B,Q,or H:
Please connect TFTP server to Ethernet port "1".
11. Type G to get the firmware image from the TFTP server.
The following message appears:
Enter TFTP server address [192.168.1.168]:
12. Type the IP address of the TFTP server and press Enter.
The following message appears:
Enter local address [192.168.1.188]:
13. Type a temporary IP address that can be used by the FortiWeb appliance to connect to the TFTP server.
The following message appears:
Enter firmware image file name [image.out]:
14. Type the firmware image file name and press Enter.
The FortiWeb appliance downloads the firmware image file from the TFTP server and displays a message similar to the following:
MAC:00219B8F0D94
###########################
Total 28385179 bytes data downloaded.
Verifying the integrity of the firmware image..
Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]?
|
|
If the download fails after the integrity check with the error message:invalid compressed format (err=1)but the firmware matches the integrity checksum on the Fortinet Technical Support web site, try a different TFTP server. |
15. Type R.
The FortiWeb image is loaded into memory and uses the current configuration, without saving the new firmware image to disk.
16. To verify that the new firmware image was loaded, log in to the CLI and type:
get system status
17. Test the new firmware image.
You can use either the web UI or the CLI to upgrade or downgrade the appliance’s operating system.
Firmware changes are either:
To determine if you are updating or reverting the firmware, go to System > Status > Status and in the System Information widget, see the Firmware Version row. (Alternatively, in the CLI, enter the command get system status.)
For example, if your current firmware version is:
FortiWeb‑VM 4.32,build0531,111031
changing to
FortiWeb‑VM 4.32,build0530,110929
an earlier build number (530) and date (110929 means September 29, 2011), indicates that you are reverting.
|
|
Back up all parts of your configuration before beginning this procedure. Some backup types do not include the full configuration. For full backup instructions, see Backups. Reverting to an earlier firmware version could reset settings that are not compatible with the new firmware. For example, FortiWeb 5.0 configuration files are not compatible with previous firmware versions. If you later decide to downgrade to FortiWeb 4.4.6 or earlier, your FortiWeb appliance will lose its configuration. To restore the configuration, you will need a backup that is compatible with the older firmware. For information on reconnecting to a FortiWeb appliance whose network interface configuration was reset, see Connecting to the web UI or CLI. |
|
|
If you are installing a firmware version that requires a different size of system partition, you may be required to format the boot device before installing the firmware by re-imaging the boot device. Consult the Release Notes. In that case, do not install the firmware using this procedure. Instead, see Restoring firmware (“clean install”). |
1. Download the firmware file from the Fortinet Technical Support web site:
2. Log in to the web UI of the FortiWeb appliance as the admin administrator, or an administrator account whose access profile contains Read and Write permissions in the Maintenance category.
|
|
Updating firmware on an HA pair requires some additions to the usual steps for a standalone appliance. For details, see Updating firmware on an HA pair. |
3. Go to System > Status > Status.
4. In the System Information widget, in the Firmware Version row, click Update.
The Firmware Upgrade/Downgrade dialog appears.
5. Click Browse to locate and select the firmware file that you want to install, then click OK.
6. Click OK.
Your management computer uploads the firmware image to the FortiWeb appliance. The FortiWeb appliance installs the firmware and restarts. The time required varies by the size of the file and the speed of your network connection.
|
|
If you are downgrading the firmware to a previous version, and the settings are not fully backwards compatible, the FortiWeb appliance may either remove incompatible settings, or use the feature’s default values for that version of the firmware. You may need to reconfigure some settings. |
7. Clear the cache of your web browser and restart it to ensure that it reloads the web UI and correctly displays all interface changes. For details, see your browser's documentation.
8. To verify that the firmware was successfully installed, log in to the web UI and go to System > System > Status.
In the System Information widget, the Firmware Version row indicates the currently installed firmware version.
9. If you want to install alternate firmware on the secondary partition, follow Installing alternate firmware.
10. Continue with Changing the “admin” account password.
|
|
Installing firmware replaces the current attack definitions with those included with the firmware release that you are installing. If you are updating or rearranging an existing deployment, after you install new firmware, make sure that your attack definitions are up-to-date. For more information, see Manually initiating update requests. |
1. Download the firmware file from the Fortinet Technical Support web site:
2. Connect your management computer to the FortiWeb console port using a RJ-45-to-DB-9 serial cable or a null-modem cable.
|
|
Updating firmware on an HA pair requires some additions to the usual steps for a standalone appliance. For details, see Updating firmware on an HA pair. |
3. Initiate a connection from your management computer to the CLI of the FortiWeb appliance, and log in as the admin administrator, or an administrator account whose access profile contains Read and Write permissions in the Maintenance category.
For details, see Connecting to the web UI or CLI.
4. Connect port1 of the FortiWeb appliance directly or to the same subnet as a TFTP server.
5. Copy the new firmware image file to the root directory of the TFTP server.
6. If necessary, start your TFTP server. (If you do not have one, you can temporarily install and run one such as tftpd (Windows, Mac OS X, or Linux) on your management computer.)
|
|
Because TFTP is not secure, and because it does not support authentication and could allow anyone to have read and write access, you should only run it on trusted administrator-only networks, never on computers directly connected to the Internet. If possible, immediately turn off tftpd off when you are done. |
7. Verify that the TFTP server is currently running, and that the FortiWeb appliance can reach the TFTP server.
To use the FortiWeb CLI to verify connectivity, enter the following command:
execute ping 192.168.1.168
where 192.168.1.168 is the IP address of the TFTP server.
8. Enter the following command to download the firmware image from the TFTP server to the FortiWeb appliance:
execute restore image tftp <name_str> <tftp_ipv4>
where <name_str> is the name of the firmware image file and <tftp_ipv4> is the IP address of the TFTP server. For example, if the firmware image file name is image.out and the IP address of the TFTP server is 192.168.1.168, enter:
execute restore image tftp image.out 192.168.1.168
One of the following messages appears:
This operation will replace the current firmware version!
Do you want to continue? (y/n)
or:
Get image from tftp server OK.
Check image OK.
This operation will downgrade the current firmware version!
Do you want to continue? (y/n)
9. Type y.
The FortiWeb appliance downloads the firmware image file from the TFTP server. The FortiWeb appliance installs the firmware and restarts:
MAC:00219B8F0D94
###########################
Total 28385179 bytes data downloaded.
Verifying the integrity of the firmware image.
Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]?
|
|
If the download fails after the integrity check with the error message:invalid compressed format (err=1)but the firmware matches the integrity checksum on the Fortinet Technical Support web site, try a different TFTP server. |
The time required varies by the size of the file and the speed of your network connection.
|
|
If you are downgrading the firmware to a previous version, the FortiWeb appliance reverts the configuration to default values for that version of the firmware. You will need to reconfigure the FortiWeb appliance or restore the configuration file from a backup. For details, see Connecting to the web UI or CLI and, if you opt to restore the configuration, Restoring a previous configuration. |
10. To verify that the firmware was successfully installed, log in to the CLI and type:
get system status
The firmware version number is displayed.
11. If you want to install alternate firmware on the secondary partition, follow Installing alternate firmware.
12. Continue with Changing the “admin” account password.
|
|
Installing firmware replaces the current FortiGuard packages with those included with the firmware release that you are installing. If you are updating or rearranging an existing deployment, after you install new firmware, make sure that your attack definitions are up-to-date. For more information, see Manually initiating update requests. |
Installing firmware on an HA pair is similar to installing firmware on a single, standalone appliance.
To ensure minimal interruption of service to clients, use the following steps.
|
|
This update procedure is only valid for upgrading from FortiWeb 4.0 MR4 or newer. If you are upgrading from FortiWeb 4.0 MR3, for example, the active appliance will not automatically send the new firmware to the standby; you must quickly connect to the standby and manually install the new firmware while the originally active appliance is upgrading and rebooting. Alternatively, switch the appliances out of HA mode, upgrade them individually, then switch them back into HA mode. |
|
|
If downgrading to a previous version, do not use this procedure. The HA daemon on the standby appliance might detect that the main appliance has older firmware, and attempt to upgrade it to bring it into sync, undoing your downgrade. Instead, switch out of HA, downgrade each appliance individually, then switch them back into HA mode. |
1. Verify that both of the members in the HA pair are powered on and available on all of the network interfaces that you have configured.
|
|
If required ports are not available, HA port monitoring could inadvertently trigger an additional failover and traffic interruption during the firmware update. |
2. Log in to the web UI of the primary appliance as the admin administrator.
Alternatively, log on with an administrator account whose access profile contains Read and Write permissions in the Maintenance category.
3. Install the firmware on the primary appliance. For details, see Installing firmware. When installing via the web UI, a message will appear after your web browser has uploaded the file:
Sending the new firmware file to the standby. Please wait and keep the web GUI untouched...
The primary appliance will transmit the firmware file to the standby appliance over its HA link.The standby appliance will upgrade its firmware first; on the active appliance, this will be recorded in an event log message such as:
Member (FV-1KC3R11111111) left HA group
After the standby appliance reboots and indicates via the HA heartbeat that it is up again, the primary appliance will begin to update its own firmware. During that time, the standby appliance will temporarily become active and process your network’s traffic. After the original appliance reboots, it indicates via the HA heartbeat that it is up again. Which appliance will assume the active role of traffic processing depends on your configuration (see How HA chooses the active appliance):
Reboot times vary by the appliance model, and also by differences between the original firmware and the firmware you are installing, which may require the installer to convert the configuration and/or disk partitioning schemes to be compatible with the new firmware version.
You can install alternate firmware which can be loaded from its separate partition if the primary firmware fails. This can be accomplished via the web UI or CLI.
1. Download the firmware file from the Fortinet Technical Support web site:
2. Log in to the web UI of the FortiWeb appliance as the admin administrator, or an administrator account whose access profile contains Read and Write permissions in the Maintenance category.
|
|
Updating firmware on an HA pair requires some additions to the usual steps for a standalone appliance. For details, see Updating firmware on an HA pair. |
3. Go to System > Maintenance > Backup & Restore.
To access this part of the web UI, your administrator's account access profile must have Read and Write permission to items in the Maintenance category. For details, see Permissions.
4. In the Firmware area, in the row of the alternate partition, click Upload and Reboot.
The Firmware Upgrade/Downgrade dialog appears.
5. Click Browse to locate and select the firmware file that you want to install, then click OK.
6. Click OK.
Your management computer uploads the firmware image to the FortiWeb appliance. The FortiWeb appliance installs the firmware and restarts. The time required varies by the size of the file and the speed of your network connection.
|
|
If you are downgrading the firmware to a previous version, and the settings are not fully backwards compatible, the FortiWeb appliance may either remove incompatible settings, or use the feature’s default values for that version of the firmware. You may need to reconfigure some settings. |
7. Clear the cache of your web browser and restart it to ensure that it reloads the web UI and correctly displays all interface changes. For details, see your browser's documentation.
8. To verify that the firmware was successfully installed, log in to the web UI and go to System > System > Status.
In the System Information widget, the Firmware Version row indicates the currently installed firmware version.
1. Download the firmware file from the Fortinet Technical Support web site:
2. Connect your management computer to the FortiWeb console port using a RJ-45-to-DB-9 serial cable or a null-modem cable.
3. Initiate a connection from your management computer to the CLI of the FortiWeb appliance, and log in as the admin administrator, or an administrator account whose access profile contains Read and Write permissions in the Maintenance category.
For details, see Connecting to the web UI or CLI.
4. Connect port1 of the FortiWeb appliance directly or to the same subnet as a TFTP server.
5. Copy the new firmware image file to the root directory of the TFTP server.
6. If necessary, start your TFTP server. (If you do not have one, you can temporarily install and run one such as tftpd (Windows, Mac OS X, or Linux) on your management computer.)
|
|
Because TFTP is not secure, and because it does not support authentication and could allow anyone to have read and write access, you should only run it on trusted administrator-only networks, never on computers directly connected to the Internet. If possible, immediately turn off tftpd off when you are done. |
7. Verify that the TFTP server is currently running, and that the FortiWeb appliance can reach the TFTP server.
To use the FortiWeb CLI to verify connectivity, enter the following command:
execute ping 192.168.1.168
where 192.168.1.168 is the IP address of the TFTP server.
8. Enter the following command to restart the FortiWeb appliance:
execute reboot
As the FortiWeb appliances starts, a series of system startup messages appear.
Press any key to display configuration menu........
9. Immediately press a key to interrupt the system startup.
|
|
You have only 3 seconds to press a key. If you do not press a key soon enough, the FortiWeb appliance reboots and you must log in and repeat the execute reboot command. |
If you successfully interrupt the startup process, the following messages appears:
[G]: Get firmware image from TFTP server.
[F]: Format boot device.
[B]: Boot with backup firmware and set as default.
[Q]: Quit menu and continue to boot with default firmware.
[H]: Display this list of options.
Enter G,F,B,Q,or H:
Please connect TFTP server to Ethernet port "1".
10. Type G to get the firmware image from the TFTP server.
The following message appears:
Enter TFTP server address [192.168.1.168]:
11. Type the IP address of the TFTP server and press Enter.
The following message appears:
Enter local address [192.168.1.188]:
12. Type a temporary IP address that can be used by the FortiWeb appliance to connect to the TFTP server.
The following message appears:
Enter firmware image file name [image.out]:
13. Type the firmware image file name and press Enter.
The FortiWeb appliance downloads the firmware image file from the TFTP server and displays a message similar to the following:
MAC:00219B8F0D94
###########################
Total 28385179 bytes data downloaded.
Verifying the integrity of the firmware image.
Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]?
|
|
If the download fails after the integrity check with the error message:invalid compressed format (err=1)but the firmware matches the integrity checksum on the Fortinet Technical Support web site, try a different TFTP server. |
14. Type B.
The FortiWeb appliance saves the backup firmware image and restarts. When the FortiWeb appliance reboots, it is running the primary firmware.
System > Maintenance > Backup & Restore lists the firmware versions currently installed on your FortiWeb appliance.
Each appliance can have up to two firmware versions installed. Each firmware version is stored in a separate partition. The partition whose firmware is currently running is noted with a white check mark in a green circle in the Active column.
Install firmware onto the alternate partition (see Installing alternate firmware).
1. Go to System > Maintenance > Backup & Restore.
To access this part of the web UI, your administrator's account access profile must have Read and Write permission to items in the Maintenance category. For details, see Permissions.
2. In the Firmware area, click Boot alternate firmware.
A warning message appears.
3. Click OK.
A message appears instructing you to refresh your browser in a few minutes after the appliance has booted the other firmware.
1. Install firmware onto the alternate partition (see Installing alternate firmware).
2. Connect your management computer to the FortiWeb console port using a RJ-45-to-DB-9 serial cable or a null-modem cable.
3. Initiate a connection from your management computer to the CLI of the FortiWeb appliance, and log in as the admin administrator, or an administrator account whose access profile contains Read and Write permissions in the Maintenance category.
For details, see Connecting to the web UI or CLI.
4. Enter the following command to restart the FortiWeb appliance:
execute reboot
5. As the FortiWeb appliances starts, a series of system startup messages appear.
Press any key to display configuration menu........
Immediately press a key to interrupt the system startup.
|
|
You have only 3 seconds to press a key. If you do not press a key soon enough, the FortiWeb appliance reboots and you must log in and repeat the execute reboot command. |
If you successfully interrupt the startup process, the following messages appears:
[G]: Get firmware image from TFTP server.
[F]: Format boot device.
[B]: Boot with backup firmware and set as default.
[Q]: Quit menu and continue to boot with default firmware.
[H]: Display this list of options.
Enter G,F,B,Q,or H:
Please connect TFTP server to Ethernet port "1".
6. Type B to reboot and use the backup firmware.