Skip to main content
arie_arie
Explorer II
June 26, 2024
Question

Disabling Initiate Traffic from FortiGate to Fortinet Global Update

  • June 26, 2024
  • 10 replies
  • 4091 views

Hi,

In the FortiGate, I can see there are traffics initiating from FortiGate' IP address (10.90.0.2) to IP Public which is globalupdate.fortinet.net.

I have configured the FGT so that it will use FortiManager as local FDN, but seems like the FortiGate still trying to IP Public by itself. How to disable it in FortiGate?

 

config system central-management
set type fortimanager
set fmg "10.1.71.57"
set fmg-source-ip 10.90.32.11
config server-list
edit 1
set server-type update rating
set server-address 10.1.71.57
next
end
set interface-select-method sdwan
endLog Traffic.jpg

 

10 replies

ozkanaltas
Valued Contributor III
June 26, 2024

Hello @arie_arie ,

 

When I reviewed your configuration, I saw the configuration for rating and update on the same line. Can you separate these configurations like that? Maybe the problem is caused by that. 

 

config system central-management set type fortimanager set fmg "10.1.71.57" set fmg-source-ip 10.90.32.11 config server-list edit 1 set server-type rating set server-address 10.1.71.57 next edit 2 set server-type update set server-address 10.1.71.57 next end set interface-select-method sdwan end

 

 

Also, can you restart fds service on Fortigate?

 

diag fmupdate service-restart fds 

 

You can follow that document for use FortiManager as FDN server.

 

https://community.fortinet.com/t5/FortiManager/Technical-Tip-Configure-FortiManager-as-a-local-FDN-server-for/ta-p/205003

 

 

 

arie_arie
arie_arieAuthor
Explorer II
June 26, 2024

Hi,

It can't separate the rating and update using same IP address.

srajeswaran
Staff
Staff
June 26, 2024

Can you configure "set include-default-servers disable " under central-management and check.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-setup-FortiGate-to-get-updates-from/ta-p/193776

arie_arie
arie_arieAuthor
Explorer II
June 26, 2024

Hi,

I tried to configure "set include-default-servers disable " but still there are traffics to fortinet.

 

WhatsApp Image 2024-06-26 at 17.12.18.jpeg

 

srajeswaran
Staff
Staff
June 26, 2024

This is to globalproductapi.fortinet.net, do you see traffic to globalupdate.fortinet.net now?
globalproductapi.fortinet.net is used for GUI icon download and not fortiguard updates- ref :
https://docs.fortinet.com/document/fortigate/7.4.0/fortios-ports/622145/anycast-and-unicast-services

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!