FortiSwitch Upgrade Status Messages: A FortiLink Field Reference

You kick off a FortiSwitch firmware push from the FortiGate switch controller, and the status column just sits there. Is it downloading, is it stuck, is it about to reboot on you in the middle of a maintenance window. The FortiGate does tell you what is happening, but it tells you across two CLI commands and a GUI panel, using strings that are not documented together anywhere. Here is what each one actually means.

Where the status actually lives

There are three places to look, and each one answers a slightly different question.

• execute switch-controller get-upgrade-status on the FortiGate, which answers “what stage of the firmware push is this switch in right now.”
• execute switch-controller get-conn-status on the FortiGate, which answers “is this switch even reachable, and is an upgrade flag set on it.”
• The GUI, under WiFi & Switch Controller > Managed FortiSwitch for day to day status and System > Firmware & Registration > Fabric Devices for the upgrade progress tray and pass or fail result.

get-upgrade-status: the Status and Next-boot fields

This is the command to run first. It lists every managed switch with its running version, current Status, and Next-boot field.

# execute switch-controller get-upgrade-status
Device            Running-version                       Status    Next-boot
=============================================================================
VDOM : root
S224DN3X17000XXX  S224DN-v7.4.5-build2662 (GA)          (0/0/0)   N/A (Idle)
S108FP5918008XXX  S108FP-v7.4.5-build2662 (GA)          (0/0/0)   Upgrading

The values that actually show up in Status and Next-boot:

get-conn-status: reading the flags

This command is less about upgrade stage and more about whether the switch is even in a state to complete one. The FLAG column is the part people skip past, and it is the part that tells you whether an upgrade or config sync is actually in flight.

# execute switch-controller get-conn-status
Managed-devices in current vdom root:
FortiLink interface : fortilink
SWITCH-ID          VERSION        STATUS          FLAG  ADDRESS      NAME
S248DN3X170002XXX  v7.4.5 (2662)  Authorized/Up   U     169.254.1.6  -
S248EPTF180018XXX  v7.4.5 (2662)  Authorized/Up   S     169.254.1.5  -

Flags: C=config sync, U=upgrading, S=staged, D=delayed reboot pending,
       E=config sync error, 2=L2, 3=L3, V=VXLAN, T=tunnel, X=External
Managed-Switches: 2 (UP: 2  DOWN: 0)

What shows up in the GUI

The GUI mirrors the CLI states but with less precision, which is exactly why it is worth knowing both.

• Managed FortiSwitch list: a gray or warning icon with status Unauthorized means the switch has not been approved yet, no upgrade will proceed until it is.
• Authorized/Up or Authorized/Down reflects the same connection state as the STATUS column in get-conn-status.
• Kicking off an upgrade from System > Firmware & Registration pops a progress tray in the bottom right corner of the GUI for the duration of the push.
• Under Fabric Devices, a failed push shows as Upgrade Failed or Upgrade Incomplete, both of which point to the same underlying problem: the switch dropped out of contact before the FortiGate could confirm the new image was running.

When Upgrading does not mean upgrading

If get-upgrade-status has been parked on Upgrading well past the time a normal image transfer takes, do not assume a corrupt image. The far more common cause is that the FortiLink connection between the FortiGate and that switch dropped mid transfer, and the FortiGate has no way to tell the difference between “still working” and “lost the switch.”

Check the FortiLink physical port state on the switch side before doing anything more invasive:

config switch physical-port
    edit port17
        set status down
    next
end

Bring the port back up, then re-run get-upgrade-status from the FortiGate to see whether the switch re-establishes contact and resumes on its own before you consider a factory reset or console recovery.

Quick reference