Steps to Push Firmware via SCP

Enable SCP on FortiGate

config system global
    set admin-scp enable
endCode language: JavaScript (javascript)

Ensure SSH access is allowed on the interface being used.

Push the firmware from your computer (Linux/MacOS/Windows/PSCP) to the FortiGate

scp <firmware_file>.out admin@<FortiGate_IP>:fgt-imageCode language: HTML, XML (xml)

Confirm the image: Once the transfer is complete, the FortiGate will verify the signature.

Alternative MethodsGUI

Go to System > Firmware, click Upload.

Note: For HA clusters, this process will typically update the subordinate units first, followed by the primary unit.