Skip to main content
Katoomba
Katoomba
Explorer
October 31, 2024
Question

Threat feed via web proxy

  • October 31, 2024
  • 3 replies
  • 1701 views

Some of our Fortigates are located behind other firewalls and the only way for those Fortigates to reach the Internet is via a web proxy. We were able to configure Fortiguard to use the web proxy to reach FDN to pull AV,IPS etc auto updates. Is there a way to configure threat feeds to use a web proxy too? If the answer is yes, how is this configured?

3 replies

saleha
Staff & Editor
saleha
Staff & Editor
November 1, 2024

Hi Katoomba,

 

Thank you for reaching out. There are no proxy settings for threat feed config. The follow are all available options in threat feed config for single entry:
config system external-resource
edit "1"
set uuid 5e39a17e-9869-51ef-9ac4-bc0202c62a13
set status enable
set type category
set update-method feed
set category 0
set username ''
set password ENC 4Nk7HoxGM3Ge/vpXvdDgBVT7qceKK7azQNwpIr0ctpOtdIj+zpbYEWAKLX5lM1foeUNstHIHBXmG9rtGtYIW4WR9GL2hCvbWVAtty7hoRn2Y6ZQgIPt89ARWSGtV95NyD8h4V77g0paHVkhdfdEvb4q9t9Ts6/wlUCDXwSDVMLItWQku1QADxNOVe7L/itT31HtyIVlmMjY3dkVA
set comments ''
set resource ''
set user-agent ''
set server-identity-check none
set refresh-rate 5
set source-ip 0.0.0.0
set interface-select-method auto
next
end

 

Thank you,

saleha

Katoomba
KatoombaAuthor
Explorer
November 1, 2024

Is there a way to get the Fortigate to use a web proxy for ALL of its access to web sites (not for firewall policy but for the Fortigate's own use)? You can configure Fortigates to access fortiguard (FDN) using a proxy. Shown below:

 

config system fortiguard   proxy-server-ip   proxy-server-port   proxy-username   proxy-password end

 

Are you saying that you cannot configure a Fortigate to access web sites using a web proxy? How is a Fortigate supposed to access a threat feed if the only available way to access the threat feed is via direct network access?

saleha
Staff & Editor
saleha
Staff & Editor
November 4, 2024

Hi Katoomba,

 

Thank you for the reply. The FortiGate can be an internal firewall with no direct internet access however in this case it can be setup with a route to access the internet via another firewall or router either for specific destinations or in the case of default/last resort route. In this scenario the internal FortiGate would send the external traffic to the next device upstream. It would the the next device upstream that has the role to pass that traffic to the destination or next hop. What I meant previously is there is no option for proxy settings in the threat feed configuration unlike the Fortiguard config where we do have such a feature available:

config system autoupdate tunneling
    set address <proxy_address>
    set password <password>
    set port <proxy_port>
    set status {enable | disable}
    set username
end

Ref article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGuard-updates-using-a-proxy-server/ta-p/191904

 

Thank you,

saleha

michelr
michelr
New Member
December 4, 2024

Hi Saleha,

i have the same problem with a FortiGate behind a Proxy Server. Autoupdate Tunneling is already configured but the thread feeds don't run.

Is there any other solution?

 

Terms & ConditionsAccessibility statement