Fortigate using proxy to update fortigurad issue

[kyle-hsuan]

Hi 

I using proxy to update fortiguard server, but it seens like fail.

following is my setting and diagnostics.

config system autoupdate tunneling

    set address 172.16.x.xxx    
    set port 80
    set status enable    

    end

config system fortiguard

   set fortiguard-anycast disable

   set port 8888

   set protocol udp

   end

--------------------

execute update-now
upd_daemon[1800]-Found cached action=00000001
do_setup[347]-Starting SETUP
upd_fds_load_default_server[920]-Addr=[208.184.237.66], weight=1787681287
upd_fds_load_default_server[920]-Addr=[12.34.97.16], weight=1247489738
upd_fds_load_default_server[920]-Addr=[173.243.138.71], weight=693776585
upd_fds_load_default_server[939]-Resolve and add fds update.fortiguard.net ip address OK.
upd_fds_load_default_server6[1046]-Resolve and add fds update.fortiguard.net ipv6 address failed.
upd_comm_connect_fds[459]-Trying FDS globalupdate.fortinet.net:443
tcp_connect_fds[168]-Proxy tunneling enabled to 172.16.x.xxx:80
negotiate_proxy_tunnel[138]-tunneling request=[CONNECT globalupdate.fortinet.net:443 HTTP/1.0
User-agent: Fortinet/7.02

] response=[HTTP/1.0 200 Connection established
Date: Thu, 20 Jun 2024 04:32:47 GMT
Connection: close
Via: 1.1 PHQPXY

]
[115] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory.cer, root ca Fortinet_CA, idx 0 (default)
[115] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory_Backup.cer, root ca Fortinet_CA_Backup, idx 1
[484] ssl_ctx_use_builtin_store: Loaded Fortinet Trusted Certs
[504] ssl_ctx_use_builtin_store: Enable CRL checking.
[511] ssl_ctx_use_builtin_store: Enable OCSP Stapling.
[814] ssl_ctx_create_new: SSL CTX is created
[841] ssl_new: SSL object is created
[194] ssl_add_ftgd_hostname_check: Add hostname checking 'globalupdate.fortinet.net'
[908] ssl_set_hostname: Set hostname 'fortinet-ca2.fortinet.com'
[707] __ssl_info_callback: before SSL initialization
[707] __ssl_info_callback: SSLv3/TLS write client hello
[707] __ssl_info_callback: SSLv3/TLS write client hello
[707] __ssl_info_callback: SSLv3/TLS read server hello
[361] __ssl_crl_verify_cb: Cert error 19, self-signed certificate in certificate chain. Depth 1
__upd_peer_vfy[329]-Server certificate failed verification. Error: 19 (self-signed certificate in certificate chain), depth: 1, subject: /DC= xxx/DC=xxx/C                                                                                                                                                                N=xxxxxxx.
[1049] ssl_connect: SSL_connect failes: error:0A000086:SSL routines::certificate verify failed
ssl_connect_fds[393]-Failed SSL connecting (5,0,Success)
[206] __ssl_data_ctx_free: Done
[1094] ssl_free: Done
[198] __ssl_cert_ctx_free: Done
[1104] ssl_ctx_free: Done

--------------------

Thanks.

[AEK]

Hi Kyle

I'm not sure UDP can be proxied.

Can you try this?

config system fortiguard
  unset port
  unset protocol
  set proxy-server-ip 172.16.x.x
  set proxy-server-port 80
end

[pminarik]

> Error: 19 (self-signed certificate in certificate chain), depth: 1, subject: /DC= xxx/DC=xxx/CN=xxxxxxx.

This is presumably your internal CA issued for corporate TLS inspection (based on the DC=X,DC=Y subject structure), performing TLS decryption/inspection of the FortiGuard-bound traffic.

You will need to exempt this traffic from being inspected. The FortiGate has a fixed set of acceptable CAs for this communication, and any deep TLS inspection will break the comms. (note that importing the CA into the FortiGate will not help)

[kyle-hsuan]

Hi @pminarik 

So, if I try to FortiGuard server not inspect, then what the IP&FQDN range of FortiGuard server are?

Thanks.

[pminarik]

In this specific case, the service getting broken is attempting access to "globalupdate.fortinet.net". Resolve that to an IP on your proxy and ensure it is exempt.

> [194] ssl_add_ftgd_hostname_check: Add hostname checking 'globalupdate.fortinet.net'

The full list of various anycast/unicast server endpoints is listed here:

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/882801/anycast-and-unicast-s...