Technical Tip: Connectivity to link-local IP 169.254.169.254 from FortiGate VM on public cloud (Azure)

This IP 169.254.169.254 is the Azure Instance Metadata Service (IMDS) endpoint. IMDS is a REST API that's available at a well-known, non-routable IP address (169.254.169.254). When a VM or VMSS instance tries to query metadata (licensing, config injection, identity tokens, instance info, bootstrap information, etc.), it contacts 169.254.169.254.

If that connection times out, it means the VM cannot reach IMDS, which normally should always be reachable from inside the VM instance.

In FortiOS, the status of the service can be verified by running the following command:

diagnose debug cloudinit show

Additionally, the following debug commands can be used to check the service status or for any errors:

diagnose debug reset
diagnose debug application azd -1
diagnose debug console timestamp enable
diagnose debug enable

For example, if the metadata connection fails, the following error will be visible in the debug logs:

2025-10-23 11:06:21 azd connection timeout: 169.254.169.254:80:169.254.169.254
2025-10-23 11:06:21 azd curl retry
2025-10-23 11:06:36 azd connection timeout: 169.254.169.254:80:169.254.169.254
2025-10-23 11:06:36 azd curl retry
2025-10-23 11:06:51 azd connection timeout: 169.254.169.254:80:169.254.169.254
2025-10-23 11:06:51 azd curl retry
2025-10-23 11:07:06 azd connection timeout: 169.254.169.254:80:169.254.169.254
2025-10-23 11:07:06 azd show instance metadata error.

In the above example, the logs of FortiGate VM on Azure did not receive any response to its query to the Azure metadata service hosted on link-local address 169.254.169.254, resulting in a connection timeout.

This could probably be because FortiGate initiates the connection request from the interface, which is not considered the primary interface by Azure. 

As per the Azure document Azure Instance Metadata Service Connection Issues, if the VM has multiple interfaces or custom routes that point IMDS traffic out a non-primary interface, the metadata request may fail. The primary interface is normally the port1 in the FortiGate. If there is any default route configured on any other interface other than port1, the other interface may be chosen, which could cause the connection failure. 

The packet sniffer command below can be used to validate the connection between FortiGate and IMDS service:

diagnose sniffer packet any 'host 169.254.169.254 and port 80' 4 0

If another interface other than port1 is observed in the packet sniffer, it is suggested to configure a static route for 169.254.169.254 on port1. For example:

config router static
    edit 5
        set dst 169.254.169.254 255.255.255.255
        set gateway x.x.x.x     <--- Azure gateway IP of port1 subnet.
        set device "port1"
    next
end