Technical Tip: FortiGuard connectivity failed when proxy tunneling is used

When using a proxy server to connect to FortiGuard under auto-update-tunneling settings, the connectivity may fail.

The proxy server can be configured under auto-update-tunneling settings as follows:

config system autoupdate tunneling
    set address <proxy_address>
    set password <password>
    set port <proxy_port>
    set status {enable | disable}
    set username
end

Note:  

In v7.6.3 and above, the ' config system autoupdate tunneling ' command has been removed and replaced with  'config system fortiguard'.  See: Changes in CLI

config system fortiguard

    set proxy-server-ip <proxy_address>

    set proxy-server-port <proxy_port>

    set proxy-username <username>

    set proxy-password <password>

end

Connectivity failures mostly occur because the proxy server is not responding to TCP connection attempts from FortiGate.

To diagnose the issue, a sniffer trace can be taken with a host filter for the proxy server IP address. In addition to the sniffer trace, FortiGuard update daemon debug is also helpful.

Three putty sessions are required with SSH access to the FortiGate unit. Logging should be enabled to save the outputs.

From Putty session #1, sniffer traces should start with the host filter as proxy server IP first:

diagnose sniffer packet any 'host <proxy_server_IP>' 6 0 l

Packet capture can be taken from the GUI too: Using the packet capture tool

From the Putty session#2, the following commands need to be executed to start the update daemon debug:

diagnose debug reset
diagnose debug application update -1
diagnose debug console timestamp enable
diagnose debug enable

From the Putty session#3, need to start the update manually using the below command:

execute update-now

To disable the update daemon debug (putty session 2 in this example), the following command is used:

diagnose debug disable

If the update fails through the proxy server, the following log traces will be observed in the update daemon debug outputs:

2025-05-26 11:29:44 upd_comm_connect_fds[457]-Trying FDS 173.243.129.6:443
2025-05-26 11:29:44 tcp_connect_fds[168]-Proxy tunneling enabled to 172.17.0.57:8180 <----- Proxy server IP and Port.
2025-05-26 11:29:44 tcp_connect_fds[235]-Binding to interface 5
2025-05-26 11:30:44 tcp_connect_fds[260]-select() timed out
2025-05-26 11:30:44 upd_comm_connect_fds[472]-Failed TCP connect

The reason for the failed TCP connection is mostly due to proxy server not responding to SYN packets sent by FortiGate as seen in the below sniffer trace:

2025-05-29 12:42:17.728879 wan out 192.168.35.2.15716 -> 172.17.0.51.8188: syn 499508116

2025-05-29 12:42:33.768905 wan out 192.168.35.2.15716 -> 172.17.0.51.8188: syn 499508116

2025-05-29 12:43:06.799393 wan out 192.168.35.2.15728 -> 172.17.0.51.8188: syn 3518981479

2025-05-29 12:43:07.798890 wan out 192.168.35.2.15728 -> 172.17.0.51.8188: syn 3518981479

The proxy server must respond and complete the TCP three-way handshake with FortiGate and allow the subsequent HTTP CONNECT requests to FortiGuard servers. If this behavior is observed, the issue is on the proxy server end.