4/20/2018 Technical Note : Loading FortiGate firmware image using TFTP

Technical Note : Loading FortiGate firmware image using TFTP Print Article

Article

Description
This article describes how to download and install firmware from a local TFTP server via the BIOS, under CLI control.

Caution: Installing firmware from a local TFTP server under console control resets your FortiGate unit to factory default settings. If possible, consider backing up your configuration before starting the
TFTP server firmware upgrade.

Components
a null modem, or RJ-45 to DB9 console cable (supplied with the FortiGate unit). See also the related article Serial cable pinouts for console access to Fortinet devices
an Ethernet RJ45 cable
a terminal client, such as a PC running HyperTerminal (Windows)
a TFTP server (see below the recommended software)

Recommended TFTP software

Windows users

TFTPD32 - Open Source tftp server for windows

[http://tftpd32.jounin.net/tftpd32.html]

3CDaemon V2 - 3com's TFTP server for windows

[http://support.3com.com/software/utilities_for_windows_32_bit.htm]

Linux users

Ubuntu 8.04 LTS, 8.10, 9.04 and 9.10

Fedora Core 9
Centos 5

tftpd-hpa
[http://freshmeat.net/projects/tftpd-hpa/]

Mac OS X 10.5/10.6 users

TFTP Server v 3.3.1

[http://ww2.unime.it/flr/tftpserver/]

Download the FortiGate firmware and verify MD5 checksum

1) Download the image for your FortiGate from the Fortinet Support Site. At the same website, you can also download the <image name>.md5 file that contains the MD5 checksum for the firmware
image you downloaded.

2) Check that the image was downloaded successfully and is not corrupted Compare your generated MD5 sum against the one in the .md5 file.

Windows users can download and use the md5sum.exe <filename> (such as : http://www.pctools.net/win32/md5sums/ or http://www.md5summer.com)
Linux users can accomplish this with md5sum <filename>
Mac OS X users can also use md5sum <filename>

Notes
Some console prompts in this procedure include a default value in square brackets, for example, [image.out]. To use this default value, press Enter.

Terminal client communication parameters

8 bits
no parity
1 stop bit
9600 baud (the FortiGate-300 uses 115,000 baud)
Flow Control = None

Steps to load the firmware image

1 - Connect the computer to the FortiGate unit using the null modem cable.

2 - Restart the Fortigate.

3 - When the console displays "Press any key to display configuration menu..." press the space bar or any other key.

4 - When a list of choice with letter of Alphabet comes up press G to continue.

5 - Connect the computer running TFTP server to the FortiGate unit. The port is prompted in the console output as below:

Please connect TFTP server to Ethernet port "MGMT"

6 - Type the IP address of the computer running the TFTP server and press Enter.
The console displays:

Enter TFTP server address [192.168.1.168]:

7 - Type the IP address of the Fortigate port that is on the same subnet as the TFTP server and press Enter.
The console displays:

Enter Local Address [192.168.1.188]:

8 - Type the firmware image file name and press Enter.

The console displays:

Enter File Name [image.out]:

The console periodically displays a "#" (pound or hash symbol) to show the download progress.

http://kb.fortinet.com/kb/viewContent.do?externalId=10338 1/2
4/20/2018 Technical Note : Loading FortiGate firmware image using TFTP

9 - When the download completes, the console displays a message similar as below, Press D.

Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]?D

The FortiGate unit installs the new firmware image and restarts. The installation may take a few minutes to complete.

Troubleshooting
Once entering the firmware image name and pressing enter, the FortiGate unit MAC address appears and the "#" symbols indicate the progress of the install. If the MAC address does not show up,
check the network cable and connector to ensure they are firmly attached to the FortiGate unit.
If MAC address shows up and no "#" signs appear, check which port the network cable is in. Use the table above in step 2 to ensure its in the right port.

Sample Console Output

The following is an example of what the output from the console can look like. Depending on the FortiGate unit, this may vary slightly.

FortiGate-200D (18:47-05.08.2013)
Ver:04000006
Serial number:FG200D4613800892
RAM activation
CPU(00:000206a7 bfebfbff): MP initialization
CPU(02:000206a7 bfebfbff): MP initialization
Total RAM: 2048MB
Enabling cache...Done.
Scanning PCI bus...Done.
Allocating PCI resources...Done.
Enabling PCI resources...Done.
Zeroing IRQ settings...Done.
Verifying PIRQ tables...Done.
Boot up, boot device capacity: 15272MB.
Press any key to display configuration menu...
..
[G]: Get firmware image from TFTP server.
[F]: Format boot device.
[B]: Boot with backup firmware and set as default.
[I]: Configuration and information.
[Q]: Quit menu and continue to boot with default firmware.
[H]: Display this list of options.

Enter Selection [G]:

Enter G,F,B,I,Q,or H:

Please connect TFTP server to Ethernet port "MGMT".

Enter TFTP server address [192.168.1.168]: 10.21.5.59

Enter local address [192.168.1.188]: 10.21.4.115
Enter firmware image file name [image.out]: FGT_200D-v5-build1165-FORTINET.out
MAC:085B0E14BB3E
###################################
Total 37651242 bytes data downloaded.
Verifying the integrity of the firmware image.

Total 262144kB unzipped.

Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]?D
Programming the boot device now.
.........................................................................................................................................
Reading boot image 1393286 bytes.
Initializing firewall...
System is starting...
Starting system maintenance...
Scanning /dev/sda2... (100%)

FG200D4613800892 login:

Related Articles
Troubleshooting Tip : Message 'invalid compressed format' or 'incomplete literal tree' during TFTP procedure

Last Modified Date: 10-27-2017 Document ID: 10338

http://kb.fortinet.com/kb/viewContent.do?externalId=10338 2/2