Technical Tip: Disable cloud communication for FortiGate in an airgap (closed network) environment

Description

This article describes how to disable cloud communication when FortiGate is in a restricted environment with no internet access.

Scope

FortiGate.

Solution

In a situation where FortiGate has no internet access, to prevent FortiGate from attempting to communicate with Fortinet public cloud servers, the following cloud communication settings must be disabled. 

Configuration parameters:

FGT # config system global
set cloud-communication disable
set fds-statistics disable
set gui-auto-upgrade-setup-warning disable
set gui-firmware-upgrade-warning disable
set gui-forticare-registration-setup-warning disable
set security-rating-run-on-schedule disable
set fortitoken-cloud disable
set fortitoken-cloud-push-status disable
end

FGT # config system autoupdate schedule
set status disable
end

FGT # config system fortiguard
set auto-join-forticloud disable
set auto-firmware-upgrade disable
set antispam-force-off enable
set antispam-cache disable
set webfilter-force-off enable
set webfilter-cache disable
set outbreak-prevention-force-off enable 
y
end

Note: The following configuration requires confirmation in CLI: 

config system fortiguard
set outbreak-prevention-force-off enable 
WARNING: This operation will disable outbreak-prevention in AV profile(s) that are using it.
Do you want to continue? (y/n)y
end

If the device is managed by FortiManager, the following configuration should also be applied:

config system central-management
set type fortimanager
set include-default-servers disable
end

Known issues:

1. Even when cloud communication is disabled, FortiGate still tries to communicate with some public FortiCloud servers in some firmware versions: Troubleshooting Tip: FortiGate is still communicating to globalproductapi.fortinet.net even with cloud-communication is disabled.

2. In an air-gapped environment, it is expected that the FortiGate will not be able to connect to FortiGuard servers.

Nevertheless, unless the FortiGate device has an offline license uploaded, 'Unable to connect to FortiGuard servers' will be shown: Technical Tip: Disable Notification of 'Unable to connect to FortiGuard servers'.

Behavior change information:

Technical Tip: Major FortiOS behavior change requiring FortiCare registration on FortiGate G series models

Related documents:

Technical Tip: Procedure to apply FortiGate firewall license to offline units

Outgoing Ports