Troubleshooting Tip: FortiManager cannot get the updates from the FDS FortiGuard server
Description
This article describes a specific scenario in which FortiManager fails to get updates from the FortiGuard FDS server.
Scope
FortiManager.
Solution
In order to obtain the FDS updates from the FortiGuard server, configure it and verify connectivity accordingly as described in Technical Tip: Verifying FortiGuard connectivity on FortiManager.
Additionally, starting from FortiManager releases v7.2.12, v7.4.8, v7.6.5 and above: the AV/IPS service must be enabled on the FortiManager.
To achieve this via the GUI: Go to FortiGuard -> Settings and ensure that the AV/IPS service is enabled for the dedicated product.
To achieve this via the CLI:
config fmupdate service
  set avips enable
end
However, in some certain scenarios, FortiManager is still not getting updates from the updates from FDS server.
To determine the problem, the following debug command needs to be executed:
diagnose debug application fdssvrd 255
diagnose debug enable
Output can be generated with the manual update:
diagnose fmupdate updatenow fds
In the logs, the following output will be observed:
fw_proto_ssl.c,609: TLSv1.3 before SSL initialization
fw_proto_ssl.c,609: TLSv1 SSLv3/TLS write client hello
TLSv1 read fatal alert: protocol version
fw_proto_ssl.c,638: TLSv1 error
__fcp_conn_cb,522: FCP_CONN error, event=4
Check update(SELPOLL) with [FGT] fds fds1.fortinet.com FAIL
__evlog_conn_status,1187: svc=FGT, addr=fds1.fortinet.com, status=-1(failed), failed_reason=1(Connect error), svrnode=addr:fds1.fortinet
This error means that FortiManager is currently configured to use the TLSv1 version for communication. When the FortiGuard server is expected to receive TLSv1.2 and higher.
This needs to be checked and configured under FDS config on FortiManager via CLI:
config fmupdate fds-setting
set fds-clt-ssl-protocol tlsv1.2
After applying this change, FortiManager can obtain the FDS updates from the FortiGuard server.
Related article:
