FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
markdr_FTNT
Staff
Staff
Article Id 211255
Description This article describes an issue whereby the Fortinet Botnet Domain Database will not automatically update and provides a solution to resolve this issue.
Scope FortiOS.
Solution

Occasionally, a situation arises whereby the Fortinet Botnet Domain Database does not automatically update.

 

Using the command:

 

diagnose autoupdate versions | grep -A5 "Botnet"

 

The version may be shown as 0.00000,  as shown in the CLI output below: 

 

 ---------
Botnet Domain Database 
--------- 
Version: 0.00000 
Contract Expiry Date: Tue Oct 20 2020 
Last Updated using manual update on Mon Jan 1 00:00:00 2001 
Last Update Attempt: n/a 
Result: Updates Installed 

 

Typically, similar issues with FortiGuard updates can be resolved using the CLI command: 

 

execute update-now  

 

However, in this situation i,t does not assist.  

 

The solution here is to assign a DNS Filter Profile to a firewall policy, and then tell the FortiGate to update. 

 

It is possible either to use an existing firewall policy or just create a dummy/temporary policy and assign a DNS Profile to it, then tell the FortiGate to update. 

 

Note that the DNS Filter Profile must have the option to redirect Botnet requests (which is the default option). 

 

Steps as follows:

 

Edit or create a DNS Filter Profile.


DNS Filter Profile.png

 

Create a dummy/test policy and assign the DNS filter to it (or add it to an existing policy).

 

Note:

Use unassigned or unused interfaces for the temporary policy.

 

DNS Filter Profile2.png

 

Tell the FortiGate to update.

 

execute update-now

 

Once the update is complete (typically it takes 2-3 minutes), check the Botnet Domain Database has been updated by re-running the following CLI command:

 

diagnose autoupdate versions | grep -A5 "Botnet"

 

In the output, find the section relating to the Botnet Domain Database to confirm it has been updated. A successful update will look similar to the below:

 

---------

Botnet Domain Database

---------

Version: 2.00466

Contract Expiry Date: Tue Oct 20 2020

Last Updated using manual update on Tue Apr  7 08:42:56 2020

Last Update Attempt: Tue Apr  7 08:42:56 2020

Result: Updates Installed

 

Related articles:

Technical Tip: Verifying and troubleshooting FortiGuard updates status and versions

Technical Tip: Antivirus extended database is not up-to-date and shows version 1.00000