Technical Tip: Configure an air-gapped FortiGate to use FortiManager as an FDN server

In general, air-gapped FortiGates are not permitted to connect to the internet. However, they need to connect to the FDN server for FortiGuard updates, license and subscription validation, etc.

1. Connect FortiGate to FortiManager, and authorize the device in FortiManager.

config system central-management

    set type fortimanager

    set fmg <FortiManager IP Address>

    set include-default-servers disable <----- Prevents FortiGate from trying the public FortiGuard servers (important in air-gapped design).

        config server-list

            edit 1

                set server-type update rating

                set server-address <FortiManager IP address>

            next

        end

    end

2. Confirm that FortiGate can connect to FortiManager by using the following commands:

diagnose debug reset

diagnose debug application update -1

diagnose debug enable

execute update-now

Disable the debug processes after 5 minutes:

diagnose debug disable
diagnose debug reset

Note: 

In some cases, FortiGate might encounter an FDN connection issue after several hours due to FortiManager undoing the configuration changes.