Troubleshooting Tip: How to troubleshoot FortiClient connectivity with FortiClient Cloud Sandbox service

In order to communicate with the FortiClient Cloud Sandbox service, FortiClient will need to be able to reach aptctrl1.fortinet.com. Depending on the endpoint's location, the sandbox URL's resolved IP addresses may vary as well:

Once a connection is established with one of the resolved addresses on port 443, a list of the actual IP addresses hosting the sandbox service on port 514 will be returned:

Connection with aptctrl1.fortinet.com established

Sandbox IP addresses returned

The endpoint will forward files to the sandbox service on port 514 if outbound traffic to it is allowed, as per FortiClient's own configuration.

The above logs can be found in C:\Program Files\Fortinet\FortiClient\logs\trace\fcaptmont_*.