| Description | This article describes how to configure FortiManager to act as a local FortiGuard server for FortiWeb. |
| Scope | FortiManager. |
| Solution |
Based on the version of FortiManager, the respective version has to be selected in the docs portal to check the supported information. The below command also helps in verifying the supported version and the models of the Fortinet devices in FortiManager:
diagnose dvm supported-platforms list detail
Configuration to be done on FortiManager and FortiWeb:
Make sure FortiManager has reachability to the FortiGuard server. Sample output below:
diagnose fmupdate view-serverlist fds Fortiguard Server Comm : Enabled Server Override Mode : Loose FDS server list : Index Address Port TimeZone Distance Source ------------------------------------------------------------------------------------------------------ *0 208.184.237.68 443 9 4 FDNI 1 208.184.237.67 443 0 5 FDNI 2 12.34.97.16 443 -5 10 FDNI 3 208.184.237.66 443 -8 11 FDNI 4 usfds1.fortinet.com 443 5 0 DEFAULT
FCT server list : Index Address Port TimeZone Distance Source ------------------------------------------------------------------------------------------------------ *0 208.184.237.75 443 -8 11 FDNI 1 usforticlient.fortinet.net 443 5 0 DEFAULT
Enable the web service and service access under System Settings -> Network and edit port1.
On FortiWeb, configure the FortiManager IP as a FortiGuard IP by enabling the override option under System -> Config -> FortiGuard and enable Override default FortiGuard address -> FortiManager IP:8890. 
The device listed on the Unauthorized devices list on FortiManager,' Right-click' on the device and select Authorize. If the ADOM is enabled, the device will be listed in the default root ADOM and can move the device to the respective FortiWeb ADOM.
Select the ADOM to where this device should be listed:
The successful authorization page looks as below:
After authorization, the devices and groups page listed with FortiWeb:
After successful communication between devices, the FortiGuard updates can be sent to the FortiWeb. Example output as below:
diagnose fmupdate view-linkd-log fds
2024/09/10_13:10:55.491 notice fds_worker[30591]: accept connection from ::ffff:10.5.x.x. 2024/09/10_13:10:55.693 info fds_svrd[30460]: Start fds server session from 127.0.0.1 2024/09/10_13:10:55.694 info fds_svrd[30460]: [FGT-->FMG] Request: Protocol=3.0| 2024/09/10_13:10:55.703 info fds_svrd[30460]: [FMG-->FGT] Response: Protocol=3.0| 2024/09/10_13:10:55.703 info fds_svrd[30460]: Process client ::ffff:10.5.x.x request SUCCESS 2024/09/10_13:10:55.703 info fds_svrd[30460]: print 0x55fa4b20bd50: cnt=4, size=4512, refcnt=4, track=0 fdssession 2024/09/10_13:10:55.703 notice fds_worker[30591]: process remote(::ffff:10.5.x.x) SUCCESS!
Debug command on the FortiManager side to validate the updates being pushed or downloaded from FortiGuard:
diagnose fmupdate view-linkd-log fds
Debug command on the FortiWeb side to validate whether the updates are being downloaded or not:
diagnose debug reset diagnose debug application updated 7 diagnose debug application fds 7 diagnose debug enable execute update-now
Related article: Technical Tip: Verifying FortiGuard connectivity on FortiManager |
