New Member

Question

Fortigate 20XF after upgrade to 7.6.4 have some mgmt traffic access fortiguard in forward traffic

Forum|Forum|9 months ago
October 22, 2025
10 replies
915 views

We have several Fortigate units (30XE and 20XF) that were upgraded from version 7.2.X to 7.6.4. After the upgrade, we noticed some strange traffic behavior.

We have defined a custom management IP and restricted it from accessing the Internet(Deny). However, after the upgrade(7.2.X>7.6.4), we observed some forward traffic where the source is the management IP and the destination is FortiGuard (which is abnormal).

At the same time, in the local traffic, we can see that the FortiGate’s WAN IP is also connecting to FortiGuard, and that traffic is allowed — which is expected (normal service)

My question is: since this unexpected forward traffic started appearing after the upgrade, could this be a bug in version 7.6.4?

All of our customer’s FortiGate devices that were upgraded (around six units) are experiencing the same behavior.

FortiGate

AEK

SuperUser

When you double-click on the log, what is the source interface and destination interface?
Is the "Dedicated Management Port" enabled for the mgmt interface?

AEK

VincentCheungAuthor

New Member

Not sure , just confirm that we didn't see that kind of situation in version 7.2.X , this the first time to see after upgrade to version 7.6.4 , and all of those fortigate which version is 7.6.4 all of this situation

AEK

SuperUser

We may be able to help if you can provide the requested information.

AEK

funkylicious

SuperUser

try setting the local-out interface for FortiGuard, https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/848980/local-out-traffic

"jack of all trades, master of none"

VincentCheungAuthor

New Member

hi funky ,

i see , i will try this

HarryTran

Staff

Hi @VincentCheung

I would love to reproduce the behavior in lab, would you share me a config file via my official email thiep@fortinet.com.

Much appreciate your help!

Regards,

Harry

VincentCheungAuthor

New Member

HI Harry ,

first thanks for your reply , i will try to check with my client if can provide config file .

beside , the situation we see , under 7.6.4 environment , set a Dedicated Management Port , and deny it access internet , Do you see the management ip traffic

in forward traffic ?

source:management IP destination:96.45.45.45 / 96.45.45.46 deny

we have 6 fortigate after upgrade to 7.6.4 do have the same Phenomenon

Sign up

Login with SSO

Login to the community

Login with SSO