Technical Tip: FortiGuard third Party SSL validation and anycast support
Description
This article describes how enable anycast in the FortiGuard settings.
Solution
Enable anycast to optimize the routing performance to FortiGuard servers is possible.
Relying on Fortinet DNS servers, the FortiGate will get a single IP address for the domain name of each FortiGuard service.
BGP routing optimization is transparent to the FortiGate.
To enable Anycast in the FortiGuard settings.
This article describes how enable anycast in the FortiGuard settings.
Solution
Enable anycast to optimize the routing performance to FortiGuard servers is possible.
Relying on Fortinet DNS servers, the FortiGate will get a single IP address for the domain name of each FortiGuard service.
BGP routing optimization is transparent to the FortiGate.
The domain name of each FortiGuard service is the common name in that service's certificate.
The certificate is signed by a third party intermediate CA.
The FortiGuard server uses the Online Certificate Status Protocol (OCSP) stapling technique, so that the FortiGate can always validate the FortiGuard server certificate efficiently.To enable Anycast in the FortiGuard settings.
# config system fortiguardAfter anycast is enabled, the FortiGuard settings will enforce a connection using HTTPS and port 443.
set protocol https
set port 443
set fortiguard-anycast enable
set fortiguard-anycast-source fortinet
end
