Technical Tip: How to allow FortiGate’s FortiGuard traffic on the upstream firewalls in the network

# config system fortiguard

    set protocol https

    set port 443

    set fortiguard-anycast enable

    set fortiguard-anycast-source fortinet

end

With the fortiguard-anycast enable, the Fortigate communicate with the IP's resolved by the below FQDN for the respective feature.

The AV/IPS FQDN:

globalupdate.fortinet.net

The WF FQDN:

globalguardservice.fortinet.net

Basically, it is necessary  to create the firewall policy in the FortiGate upstream Firewalls allowing the above two FQDN's so that the FortiGate can communicate with the FortiGuard servers.