Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
grantjonas22
New Contributor

Issue with AV Definitions Auto-Update

Hi all, 

 

I am managing a FG 300D cluster for a client, and they're reporting that AV auto-updates are not kicking off everyday at 1 AM.

 

This client has sort of a rigged UTM license situation going on, he only pays for a UTM license on the master unit of this cluster. Because of this, his IPS and AV licenses read as 'expired'. My first thought was that this would absolutely cause an issue with AV, but he assures me that there was no auto-update issue until they upraged from 5.2.6 to 5.4.4.  

 

I have the following questions:

 

-Do both cluster members need a UTM license in order to actually use things like AV and IPS?

-Is there a way that I can verify auto-updates are, or are not, kicking off every day at 1AM?

-What is the best way to test/troubleshoot an AV Auto-Update?

 

I have browsed numerous KB articles, and am already familiar with cmd's like diag autoupdate version/status, these don't seem to be providing me with conclusive evidence that auto-updates are functioning, or not. 

 

Here is a screencap showing config pertaining to AV, and auto-updates:

 

FGT3HD3914802363 # conf antivirus settings
 
FGT3HD3914802363 (settings) # show full
config antivirus settings
    set default-db extended
    set grayware enable
end

 

FGT3HD3914802363 (schedule) # show full
config system autoupdate schedule
    set status enable
    set frequency daily
    set time 01:60
end

 

2 REPLIES 2
RobertReynolds
Contributor

In a HA cluster, whether A-A or A-P, both Fortigates need to have the same level of security subscriptions. This is because if one fails and the other has to then take over, it needs to have the same subscriptions to be able to continue inspecting the traffic

 

If they have differnet levels of support, the cluster will take the lowest common denominator.

neonbit

I'd recommend running a update debug and initiate the update manually to see if there are any errors.

 

diag debug application update -1

diag debug enable

execute update-now

 

The output will be long so best save to a log file in putty. When finished execute the following to disable

 

diag debug application update 0

diag debug disable

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors