Technical Tip: How to find the public IP address of a FortiManager/FortiAnalyzer Cloud instance

Identifying the public IP address of the FortiManager/FortiAnalyzer Cloud instance is often necessary for whitelisting purposes, especially in environments with strict network access controls or firewalls that only allow communication with approved IPs.

To retrieve the public IP address of a FortiManager or FortiAnalyzer Cloud instance running version 7.4.7 build 6767 or newer, use the following CLI commands:

Note:

This functionality is not yet implemented in FortiManager/FortiAnalyzer v7.6 Cloud, but it is planned to be added in a future v7.6.x release.

FMG-CLOUD # diagnose debug enable
FMG-CLOUD # diagnose test application vmd 20
FMG-CLOUD # 154.52.17.20

Useful CLI commands

• On FortiGate:

1. Check the FortiManager Cloud IP address 

execute ping fortimanager.forticloud.com
FGT # execute ping fortimanager.forticloud.com

Example of output:

PING fortimanager.forticloud.com.geo.fortinet.net (154.52.2.162): 56 data bytes
64 bytes from 154.52.2.162: icmp_seq=0 ttl=51 time=38.2 ms
64 bytes from 154.52.2.162: icmp_seq=1 ttl=51 time=37.9 ms
64 bytes from 154.52.2.162: icmp_seq=2 ttl=51 time=37.9 ms
64 bytes from 154.52.2.162: icmp_seq=3 ttl=51 time=38.1 ms
64 bytes from 154.52.2.162: icmp_seq=4 ttl=51 time=38.3 ms

2. Override FortiManager Cloud IP using local DNS database (if required).

This step may be considered if FortiGate resolves an incorrect IP address for the FortiManager Cloud service. Such behavior can be related to DNS resolution issues, regional mapping, or environmental factors.

It is recommended to review this scenario with Fortinet TAC before applying any manual override, as incorrect configuration may impact connectivity or service behavior.

config system dns-database
    edit "forticloud.com"
        set domain "forticloud.com"
            config dns-entry
                edit 1
                    set hostname "fortimanager"
                    set ip <FMG_CLOUD_IP>
                next
            end
    next
end

3. Sniffer packet capture on FGFM tunnel (port 541):

diagnose sniffer packet any 'port 541' 6 0 a

4. FGFM tunnel debug:

diagnose debug reset
get system status
diagnose debug application fgfm 255
diagnose debug enable

• On FortiManager Cloud:

FGFM tunnel debug:

diagnose debug reset
get system status
diagnose debug application fgfm 255 <FORTIGATE_DEVICE_NAME>
diagnose debug enable

Note: To retrieve the FortiGate device name:

diagnose dvm device list

Related article:

Technical Tip: How to obtain the public IP for FortiManager Cloud and FortiAnalyzer Cloud