Technical Tip: How to allow FortiGate’s FortiGuard traffic on the upstream firewalls in the network

[fquerzo_FTNT]

Description
This article shows how to allow the FortiGate’s FortiGuard traffic on the upstream firewalls when the FortiGate has 'fortiguard-anycast' enabled.
Solution

In FortiOS v6.2.2 and later, you can enable fortiguard-anycast on Fortigate to optimize the routing performance to FortiGuard servers 

# config system fortiguard

    set protocol https

    set port 443

    set fortiguard-anycast enable

    set fortiguard-anycast-source fortinet

end

With the fortiguard-anycast enable, the Fortigate communicate with the IP's resolved by the below FQDN for the respective feature.

The AV/IPS FQDN:

globalupdate.fortinet.net

The WF FQDN:

globalguardservice.fortinet.net

Basically, it is necessary  to create the firewall policy in the FortiGate upstream Firewalls allowing the above two FQDN's so that the FortiGate can communicate with the FortiGuard servers.