Technical Tip: How to troubleshoot FortiGate Cloud internal error

If the following error appears in the GUI:

Or the same message is observed in CLI:

• Check the connectivity from FortiGate to the following servers:

execute ping logctrl1.fortinet.com

execute ping globallogctrl.fortinet.net

execute ping service.fortiguard.net

execute ping guard.fortinet.net

execute ping securewf.fortiguard.net  -----> Used for HTTPS service.

execute ping update.fortiguard.net

If they are not reachable, then check DNS reachability on FortiGate and troubleshoot it accordingly: Technical Tip: DNS stops working when using custom DNS.

• Troubleshooting:

When deploying units in a high-availability (HA) cluster, ensure that each device is registered individually to the appropriate FortiCloud account.

Refer to this article for step-by-step guidance:
Technical Tip: How to register and activate a FortiCloud account 

Proceed with the following steps if the issue persists: 

config system fortiguard

    set auto-join-forticloud enable

end

config system fortiguard
    unset service-account-id
end

config system central-management

    set type fortiguard 

end 

diagnose fdsm contract-controller-update
fnsysctl killall fgfmd

• Try logging in to FortiCloud using the command below:
  
  

execute fortiguard-log login <email> <password> <location>

There are three options for domains like GLOBAL/EUROPE/US.

• Restart the forticldd process, make sure it generates a new process ID after the restart.

diagnose sys process pidof forticldd    ------> To check the process ID of forticldd.

diagnose sys kill 11 <forticldd pid>    ------> Restart the specific process id.

fnsysctl killall forticldd              ------> Restart all instances of forticldd.

• Make sure port 514 is not blocked.

1. Find the FortiCloud server IP used by the FortiGate to connect:

diagnose test application forticldd 3

Debug zone info:
    FAZCLOUD:
    Domain:EUROPE
    Home log server: 154.52.10.188:514
    Alt log server: 154.52.10.143:514
    Active Server IP:      154.52.10.188
    Active Server status:  up
    Log quota:      500000000MB
    Log used:       36MB
    Daily volume:   1000000MB

2. Perform a telnet command on FortiGate to check the connectivity:

execute telnet 154.52.10.188 514
Trying 154.52.10.188...
Connected to 154.52.10.188.   

• If the issue persists, it is highly recommended to focus on the results of debug commands:

diagnose debug disable

diagnose debug reset

diagnose debug application forticldd -1

diagnose debug enable

The following errors may be seen:

1 ----> If the debug has the following entry.

[1060] ssl_connect: SSL_connect failes: error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version

Adjust the SSL versions accordingly, as shown below:

config system global
    set ssl-min-proto-version TLSv1-2
end

2 ----> From debugs, FortiGate Cloud seems already logged out.

[105] fds_print_msg: Status:down
[105] fds_print_msg: APTCurrentServer:0.0.0.0:0
[105] fds_print_msg: APTStatus:unknown
[105] fds_print_msg: AccountID:

• Along with the 'forticldd' debug, packet capture for FortiGate Cloud IPs helps to further narrow down the issue.

diagnose sniffer packet any 'net 208.91.113.0/24 or net 173.243.132.0/24' 6 0 l

The issue can also occur due to a low PMTU of the link over which FortiCloud traffic is routed. In that case, test by trying to adjust the MTU of the external interface to lower values:

config system interface

    edit <interface_name>

        set mtu-override enable

        set mtu <value>

    next

end

Note:

The source IP and interface used to initiate the connection to the FortiCloud server are specified under the 'config log fortiguard setting'. It is 'auto' by default, which is similar to the FortiGuard setting.

config log fortiguard setting

     set source-ip <- IP address of the WAN interface that can reach service.fortiguard.net.

     set interface-select-method specify   <----- Specify the interface selection method to be the same as FortiGuard.

     set interface <interface>         <----- Specify the interface.

end

If the issue persists, open a support ticket with Fortinet and attach the Configuration file along with the debug outputs captured above and the output of these commands:

diagnose fdsm account-info
diagnose fdsm log-controller-update
diagnose fdsm contract-controller-update

diagnose test application forticldd 1

diagnose test application forticldd 2

diagnose test application forticldd 3

Related documents:

Technical Tip: FortiGate Cloud Report shows error 'Internal Server Error'

Troubleshooting Tip: FortiCloud internal error when activating a FortiCloud account on FortiGate

FortiGate Cloud Port and access control information 

Troubleshooting Tip: FortiCloud connection failure

Troubleshooting Tip: Resolve 'Haven't set FortiCloud account id' by adding a FortiGuard service-account ID
Technical Tip: Failed to activate FortiCloud account on FortiGate. Error: 'acct_st=Error