Technical Tip: FortiGate cannot update IPS and antivirus databases

This article describes one possible scenario when FortiGate is not updating security databases, such as antivirus and Intrusion Prevention System (IPS) databases.

Connection to FortiGuard is successful, and there may not be an error in debugging of the update daemon.

To check the debug when FortiGate is updating to FortiGuard, run the following command:

diagnose debug app update -1

diagnose debug enable

fnsysctl killall updated

execute update-now

If the following entry is in the debug log, the update of the respective databases is disabled due to a setting in FortiGate:

__update_upd_comp_by_settings[473]-Disabling FLEN components.
__update_upd_comp_by_settings[477]-Disabling NIDSDB/ISDB/MUDB components.
__update_upd_comp_by_settings[481]-Disabling APPDB/IOTDB components.
__update_upd_comp_by_settings[485]-Disabling AVEN components.
__update_upd_comp_by_settings[489]-Disabling AVDB/FLDB/MMDB components.

1. Cross-check the firewall policy and ensure that a security profile, such as antivirus and/or IPS, is configured on at least 1 of the firewall policies.
   
2. Ensure that the policy that has been configured with the security profile is not in disabled state mode.

FortiGate obtains updates of security databases from FortiGuard only if the respective feature is used.  If no policy is configured with the respective security profile feature, FortiGate will not download the update as the components are not in use.

If the configured policy is disabled, FortiGate will not download the update to the respective database. After enabling antivirus and/or IPS in one of the policies, run the 'execute update-now' command again. If there are no changes in the definitions, contact Technical Support for assistance or consider updating definitions manually. Refer to:

Technical Tip: How to manually upgrade the IPS Engine
Technical Tip: How to manually update the Virus Definition database or AntiVirus Engine 

Scenario 1: Encountering the error message 'Failed to upgrade database' during the Antivirus database update.

 
FortiGate # diagnose debug disable
FortiGate #diagnose debug application update -1
FortiGate #diagnose debug enable

upd_manual_virdb[60]-Updating virus db
doInstallUpdatePackage[928]-Pkg has wrong firmware version-07006000 <------
upd_install_pkg_file[1275]-Installation of pkg /tmp/monitor_upload_gXEkA3 has failed
upd_manual_virdb[72]-Failed installing pkg file

This issue may be caused by updating the incorrect antivirus database version pkg file, resulting in a mismatch with the FortiOS version.

vsigupdate-OS7.60_7.049_GA_signed_ENG_ALL.pkg <---- This pkg file is valid for FortiOS v7.6.x.

vsigupdate-OS7.40_7.051_GA_signed_ENG_ALL.pkg <----- This pkg file is valid for FortiOS v7.4.x.

Related articles:

Technical Tip: Explanation to old update values in get system

Troubleshooting Tip: IPS definition showing version 0.0000 in FortiGuard