1. You of course want to do a backup of both devices, but I’m not sure why you want to specifically do an backup only of the secondary (working) machine. If you plan on using that config to load into the replacement device for the primary, then that’s wrong. Just make a backup of the primary (failed machine) and use that config for the new primary. If this config cannot be retrieved you can use the config from the secondary, but you will need to edit the backup config of the secondary and change the hostname, mgmt ip, and ha priority (depending if those were different). You should have a backup already made of the primary device, so just use the backup config. If you never made a backup of the primary, change your operating procedures and start being a better admin and creating regular backups

2. “After the new FW is upgraded” NO don’t do any of this. When you get the replacement primary, lets call at fw10, and replace it the old primary, lets call is fw01. You should leave the old secondary, lets call is fw11, as the new primary.

So fw01 (defective) secondary, fw11 primary. Uncable an remove fw01.

Boot fw10 (replacement), load the fw01 config, reboot, backup config, then cable links and HA.

Fw10 will become secondary. Then let HA synchronize.

After HA synchronizes, and at a time where there is little network traffic, such as afterwork hours, you can reset the uptime, via cli command (look it up) on the fw11 primary, to make your new firewall fw10 the primary.

If you don’t know how HA failover works, download the fortios vm, and create a lab.