Fortianalyzer activate license, connecting to forticare via proxy

[mhdganji]

Hi,

I just purchased a FAZ and received the license file. Uploading the license file is successful and after login to FAZ 7.2 it goes to register with Forticare and says : Failed to connect to FortiCare servers.

The appliance is in a secure zone and it can be only connected to Internet via a proxy server. I mean every connection such as DNS, HTTPS, ICMP, etc to Internet is only possible through a proxy server.

In this situation, how can I set the FAZ to use that prox for connecting to forticare and complete the process and let me login and set up my device.

I used config system web-proxy and it didn't work. Instantly it says:

Failed to connect to FortiCare servers.

Is there anyway to solve this and send all the traffic to the proxy server?

Or maybe there is another trick to this?

BTW, possible to skip this for now?

Regards,

[srajeswaran]

Can you try uploading the entitlement file using TFTP as suggested in below article.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-configure-FortiAnalyzer-FortiMa...

[mhdganji]

I made a request ticket for getting entitlement file and am waiting for it.

Hope to get it soon. (And hope to make it downloadable and available in your Fortinet panel without needing to request for it)

I thought my question will help me to update and connect to Fortiguard servers in the future so I'm still looking for a solution to it if possible.

Regards,

[srajeswaran]

After configuring proxy, can you check if the connectivity towards Fortiguard using below commands?

diagnose fmupdate view-serverlist fgd
diagnose fmupdate view-serverlist fds
exe ping fds1.fortinet.com

[mhdganji]

definitely exe ping fds1.fortinet.com will not work cause as I said there is no way (no default gateway to Internet) for this device. Registration to Forticare, getting updates, etc should always use the proxy provided for the system.

So, I think we should consider these options :

1- Define a system-wide proxy to relay all connections (including ping and all needed to reach Fortiguard servers)

2- Getting an offline file (like the license itself) to skip this step

3- Using another command to ask the system connect to Forticare via a proxy (I think config system web-proxy is not the suitable command for this)

Regards,

[srajeswaran · Accepted solution]

The proxy need to be defined under "config fmupdate av-ips web-proxy"

config fmupdate av-ips web-proxy

set address <string>

set mode {proxy | tunnel}

set password <password>

set port <integer>

set status {enable | disable}

set username <string>

end

[mhdganji]

Thanks !

After setting these and waiting for a few minutes, The next logon displayed a check mark beside the register with Forticare and I finished setting up my device.

Regards,

[srajeswaran]

Thats great to hear.