Troubleshooting Tip: High Availability secondary unit cannot connect to FortiGuard servers

[ychia]

Description	This article describes an issue where secondary HA cluster units cannot connect to the FortiGuard servers to perform updates.
Scope	Any supported version of FortiGate.
Solution	In an HA cluster, customers with individual cluster units enabled with a reserved management interface for UI access find that secondary units cannot connect to FortiGuard servers. The following error message shows in the UI: This behavior is expected. Secondary unit FortiGates are not intended to be able to communicate with the FortiGuard server directly for security reasons. The secondary unit is behaving as intended. Instead, use the primary FortiGate to communicate with the FortiGuard servers and update the Secondary FortiGate. See the FortiGate Cookbook for instructions. Even if the HA is in A-A or A-P enabled with a reserved management interface, this is expected behavior.