Technical Tip : How different FortiOS can reach FortiGuard servers using backup ADOM with FortiManager

Description

This article describes how FortiGate devices in backup ADOM mode with FortiManager automatically resolve and connect to public FortiGuard Distribution Network (FDN) servers for threat intelligence updates (e.g., AV, IPS signatures), eliminating manual server lists. This differs from legacy behaviors in 5.2.x (manual for 5.2.1/5.2.2; auto for 5.2.3+).

Backup mode ensures FortiManager proxies non-critical updates while allowing direct FDN access for rating/threat feeds. IPv6 FDN support is native in 7.6.x; use for high-availability setups with FortiManager Cloud integration.

• On v5.0, the FortiGate had to use FortiManager for FDS update.
• On v5.2.1 and v5.2.2 GA, the FortiGate can reach the FDN network manually applying the public IP as server-list under the central-management configuration.
• Starting with v5.2.3 GA, the FortiGate can reach the FDN network by default without any server-list.

Solution

Note: 

These apply only to pre-7.0

For v7.6.4, use the modern method below:

Under config system central-management note: "Commands like set server-list and diagnose fmupdate fgd-serverlist are removed in 7.4+; use get system fortiguard-service status instead."

Convert step 3 into a FortiManager script to apply to all the FortiGates managed by the same backup ADOM. Configuring automatically the public FortiGuard servers IP on central-management configuration on v5.2.3 and latest GA

Connect to the FortiGate via SSH, set the backup mode and leave enable "include-default-servers".

config system central-management
       #set mode backup
    #set type fortimanager
    #set fmg "1.2.3.4"
    #set include-default-servers enable  <--------------default
#end

Note:

• On v5.2.3 GA and latest, by default the FortiGate is able to use public IP for FortiGuard updates and to synchronize in the main time its configuration to FortiManager.

Modern Configuration in v7.6.4:

v7.6.4 auto-detects FDN servers via DNS; no manual lists needed in backup ADOM.

On FortiGate (authorize to FortiManager first):

config system central-management
set type fortimanager
set fmg <FMG-IP>
set fmg-serial-number <FMG-SN> # From FortiManager
end

Enable direct FDN in backup mode (auto by default):

config system fortiguard-service
set update-server-location any # Or specific region: us/eu/ap/jp
set proxy enable # If behind proxy: set proxy-server <IP> port 8080
set ipv6 enable # For dual-stack
end

On FortiManager (ADOM setup):

config system adom
edit <ADOM-name>
set mode backup
set auto-authorize enable # Auto-sync devices
next
end

Trigger and verify:

execute update-now
get system fortiguard-service status # Shows FDN connection
diagnose debug application fds -1 # Debug logs

Related documents:

Configure FortiManager v5.0 in backup mode & Confirm Auto-Retrieve works

FortiOS 7.6.4 FortiGuard Guide

FortiManager 7.6.0 ADOM Management