|
Scenario:
In cases where the Internet access is routed to an SD-WAN IPSec VPN tunnel interfaces to a remote site B when BGP is used as the routing protocol and it advertises the default route to site A, with site A having the public circuits over which the tunnels are attached, sometimes there's a requirement to split FortiGuard traffic at site A to locally update licenses and security databases, rather than going to the remote site B.
Solution:
In the above cases, at site A create a static route using a public interface with a low distance, lower than the 200 distance of the BGP default route, set the destination to the FortiGuard FQDNs (see relevant article below), and adjust the FortiGuard configuration.
Relevant configuration excerpts from FortiGate at site A (port1 is the public interface):
config firewall address
edit "service.fortiguard.net"
set type fqdn
set associated-interface "port1"
set allow-routing enable
set fqdn "service.fortiguard.net"
next
edit "securewf.fortiguard.net"
set type fqdn
set associated-interface "port1"
set allow-routing enable
set fqdn "securewf.fortiguard.net"
next
edit "update.fortiguard.net"
set type fqdn
set associated-interface "port1"
set allow-routing enable
set fqdn "update.fortiguard.net"
next
... <---- Other FortiGuard FQDNs.
end
end
config firewall addrgrp
edit "FortiGuard_FQDNs"
set allow-routing enable
set member "service.fortiguard.net" "securewf.fortiguard.net" "update.fortiguard.net"
"usupdate.fortinet.net" "usservice.fortiguard.net" "ussecurewf.fortiguard.net" <fqdn>
<fqdn>............."
next
end
config router static
set gateway 10.9.15.254
set device "port1"
set dstaddr "FortiGuard_FQDNs"
next
end
Routing table for VRF=0
B* 0.0.0.0/0 [200/0] via 10.8.8.1 (recursive via ipsec tunnel 10.10.10.35), 00:14:48, [1/0]
S 12.34.97.16/32 [10/0] via 10.9.15.254, port1, [1/0] <----FortiGuard FQDN
S 12.34.97.18/32 [10/0] via 10.9.15.254, port1, [1/0] <----FortiGuard FQDN
S 12.34.97.71/32 [10/0] via 10.9.15.254, port1, [1/0] <----FortiGuard FQDN
.
.
.
On configuring the above, the error message at site A 'Unable to Connect to Fortiguard Servers' will disappear from the dashboard, and the licenses and security databases will be updated locally at site A rather than via site B.
Note: It is necessary to use the relevant FortiGuard FQDNs from the link below to match the geolocation configuration and requirements.
Related articles:
Troubleshooting Tip: FortiGate FortiGuard Servers
Technical Tip: Communicating with FortiGuard Servers when FortiGate has no internet access or limite...
|
