FortiGate Firmware Upgrade Path
There is no single global FortiGate firmware chain (for example “always 7.2 → 7.4 → 7.6”). Fortinet publishes a per-model upgrade path: a sequence of tested builds from your current version to your target. Use Fortinet’s Upgrade Path Tool with your exact model, current build and target build, then install each hop in order. Read the release notes for every step — especially before moving to a new major version.
Megatron Technology Pte Ltd, Singapore. We size and supply Fortinet.
Related pages: Fortinet · FortiOS 7.6 removed SSL VPN on small FortiGates · FortiGate conserve mode on small units · Knowledge base
What is a FortiGate upgrade path?
An upgrade path is a platform-specific sequence of supported firmware images. Each hop has been validated by Fortinet QA. Skipping ahead can cause configuration loss, management problems, HA issues, or worse. Paths differ by model and by start/target version — that is why a one-size-fits-all chain is the wrong advice for a buyer or an IT lead approving downtime.
Fortinet’s public Upgrade Path Tool (docs.fortinet.com) is the normal place to look this up. Enter the product (FortiGate / FortiOS), the exact hardware or VM model, the firmware you are on today, and the firmware you want to reach. The tool returns the shortest recommended path. Paths are updated over time, so check again shortly before the maintenance window — even if you ran the same jump on another unit last quarter.
How should a Singapore office plan the upgrade?
Confirm model and existing firmware. Desktop 40F/60F paths are not interchangeable with mid-range or VM platforms.
Decide the target. Patch within a major/minor you already trust, or move to a newer train (for example into 7.4 or 7.6) for features or security fixes.
Run the Upgrade Path Tool for that exact current → target pair. Save or export the hop list.
Read release notes for every hop — special notices, known issues, and behaviour changes. Do not only read the final target notes.
Check fabric compatibility. If you use FortiManager or FortiAnalyzer, upgrade those first (Fortinet’s usual order is FortiManager → FortiAnalyzer → FortiGate).
Back up configuration before the first hop. On VMs, take a snapshot. Schedule a window long enough for multiple reboots if the path has several steps.
Follow the hops in order. Wait for services to stabilise between installs. Test after each step so you can boot the alternate partition (one step back) if needed.
What about FortiOS 7.6 and SSL VPN?
If your target is in the 7.6 train, treat remote-access changes as a planning item, not a surprise after reboot. Fortinet’s 7.6 release notes describe SSL VPN tunnel mode being replaced by IPsec VPN (from 7.6.3 on all models), and Agentless VPN (formerly SSL VPN web mode) no longer available on listed small models. Read the 7.6 notes before you move — and see our companion guide FortiOS 7.6 Removed SSL VPN on Small FortiGates for the buyer-level impact.
Common mistakes to avoid
| Mistake | Better approach |
|---|---|
| Assuming every FortiGate follows the same major-version ladder | Query the path tool for this serial’s model and builds |
| Jumping straight to the target image | Install each intermediate build the tool lists |
| Reading only the final release notes | Read special notices for every hop |
| Upgrading FortiGate before FortiManager/Analyzer | Align management stack first when those products are in use |
| No backup / no rollback plan | Config backup (and VM snapshot); test after each hop |
Frequently asked questions
Can we upgrade directly if the GUI offers a “direct” option?
FortiOS may offer a direct jump alongside “follow upgrade path.” Fortinet recommends following the tested path. Direct upgrades can risk configuration loss or a totally bricked Fortigate..
Is there a supported downgrade path?
No. Fortinet does not publish supported downgrade paths. Physical units can often reboot to the previous partition (one step back). Plan upgrades carefully rather than relying on rolling back many versions.
What happens if I don’t follow the upgrade path?
In the worst case scenario, the Fortigate may not be able to boot up. The fortigate might have to be re-imaged, which requires console access, an ftp or tftp server, and physical access to the device.
Does FortiCare matter for firmware?
Yes. FortiCare is what entitles you to firmware updates and technical support when an upgrade goes wrong. Keep contracts current before a major jump.
Plan a FortiGate firmware upgrade with a Singapore reseller
Megatron Technology Pte Ltd (est. 1990, UEN 199002644W) is a Singapore Cisco Networking Partner and Managed Services Provider, and a Fortinet reseller. We design, size, licence, procure, deploy and support Cisco Meraki, FortiGate, and Cisco Catalyst & Data Centre from 2 Kallang Avenue #08-17 CT Hub, Singapore 339407.