Technical Tip: FortiManager access to FortiGuard since versions 7.2.12, 7.4.8, 7.6.5 and later

To resolve the issue of being unable to connect to FortiGuard servers from FortiManager, follow these steps:

As of FortiManager v7.2.12, v7.4.8, v7.6.5 and above: AVIPS service must be enabled on the FortiManager.

To do this in the GUI: Go to -> System -> FortiGuard -> Service and ensure that the AVIPS service is enabled.

Using the CLI:

config fmupdate service
    set avips enable
end

When 'set avips disable' is configured, it prevents updates from FortiGuard to FortiManager, such as downloading firmware or verifying licenses of managed devices.

Additionally, if FortiManager is reaching the internet via proxy, verify that FortiManager is configured to use the correct proxy settings. Go to System -> Network -> Proxy and ensure the proxy server IP address and port number are correctly configured.

Ensure that the proxy server (if any) is configured to allow connections to FortiGuard servers.

This can be done by adding the following URLs to the proxy server's allow list:

• *.fortinet.com.
• *.fortiguard.com.
• *.fortinet.net.

Verify connectivity:

Use both GUI and CLI to check the connection and service health:

• GUI: FortiGuard -> Status displays connection to FortiGuard or internal FDS.
• CLI Diagnostics:

diagnose fmupdate fds show

diagnose fmupdate fds connect <service>

diagnose fmupdate view-fds-stat

diagnose fmupdate view-fds-detail

execute ping fds1.fortinet.com