loopback as source for FortiGuard

How did you determine this ?

Also to recheck did you ensure the loopback is in your default vdom "root" or the management vdom?

Can you execute a ping from that source interface to the fortiguard?

Hi - thanks for your reply!

Yes - the loopback is within management vdom and fortiguard services are reachable via PING.

FGT60C (root) # execute ping-options source <loopback-address>

FGT60C (root) # execute ping service.fortiguard.net PING guard.fortinet.net (208.91.112.198): 56 data bytes 64 bytes from 208.91.112.198: icmp_seq=0 ttl=45 time=169.7 ms 64 bytes from 208.91.112.198: icmp_seq=4 ttl=45 time=169.6 ms

--- guard.fortinet.net ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 169.6/169.8/170.3 ms

But a sniffer for HTTPS traffic results in a source-ip different to the loopback.

The outgoing interface (in my configuration a ipsec vpn) is the same for both (ping and https).

[size="1"]FGT60C (root) # diagnose sniffer packet any 'port 443' 4 interfaces=[any] filters=[port 443][/size]

25.294676 <name-of-tunnel> out <ip-internal-interface>.2460 -> 96.45.33.89.443: syn 2615744967 25.301772 <name-of-tunnel> out <ip-internal-interface>.2461 -> 208.91.112.68.443: syn 1102060009

For any other service using the loopback as source it is working perfect.

FGT60C (global) # get system source-ip status The following services force their communication to use a specific source IP address:

service=NTP source-ip=<loopback-address> service=DNS source-ip=<loopback-address> service=Fortiguard source-ip=<loopback-address> service=Syslog #2 source-ip=<loopback-address> service=Alert Email source-ip=<loopback-address>

=======finished getting system source-ip status=======

 Will mine is the following;

  get system source-ip status The following services force their communication to use a specific source IP address: service=Fortiguard source-ip=x.x.x.x =======finished getting system source-ip status======= 15KDFG (global) #

I would do a diag sniffer packey any "host <loopback address >" and see the traffic generated  by the loopback an execute update-now