Threat feed via web proxy

[Katoomba]

Some of our Fortigates are located behind other firewalls and the only way for those Fortigates to reach the Internet is via a web proxy. We were able to configure Fortiguard to use the web proxy to reach FDN to pull AV,IPS etc auto updates. Is there a way to configure threat feeds to use a web proxy too? If the answer is yes, how is this configured?

[saleha]

Hi Katoomba,

Thank you for reaching out. There are no proxy settings for threat feed config. The follow are all available options in threat feed config for single entry:
config system external-resource
edit "1"
set uuid 5e39a17e-9869-51ef-9ac4-bc0202c62a13
set status enable
set type category
set update-method feed
set category 0
set username ''
set password ENC 4Nk7HoxGM3Ge/vpXvdDgBVT7qceKK7azQNwpIr0ctpOtdIj+zpbYEWAKLX5lM1foeUNstHIHBXmG9rtGtYIW4WR9GL2hCvbWVAtty7hoRn2Y6ZQgIPt89ARWSGtV95NyD8h4V77g0paHVkhdfdEvb4q9t9Ts6/wlUCDXwSDVMLItWQku1QADxNOVe7L/itT31HtyIVlmMjY3dkVA
set comments ''
set resource ''
set user-agent ''
set server-identity-check none
set refresh-rate 5
set source-ip 0.0.0.0
set interface-select-method auto
next
end

Thank you,

saleha

[Katoomba]

Is there a way to get the Fortigate to use a web proxy for ALL of its access to web sites (not for firewall policy but for the Fortigate's own use)? You can configure Fortigates to access fortiguard (FDN) using a proxy. Shown below:

config system fortiguard
  proxy-server-ip
  proxy-server-port
  proxy-username
  proxy-password
end

Are you saying that you cannot configure a Fortigate to access web sites using a web proxy? How is a Fortigate supposed to access a threat feed if the only available way to access the threat feed is via direct network access?

[saleha]

Hi Katoomba,

Thank you for the reply. The FortiGate can be an internal firewall with no direct internet access however in this case it can be setup with a route to access the internet via another firewall or router either for specific destinations or in the case of default/last resort route. In this scenario the internal FortiGate would send the external traffic to the next device upstream. It would the the next device upstream that has the role to pass that traffic to the destination or next hop. What I meant previously is there is no option for proxy settings in the threat feed configuration unlike the Fortiguard config where we do have such a feature available:

config system autoupdate tunneling
    set address <proxy_address>
    set password <password>
    set port <proxy_port>
    set status {enable | disable}
    set username
end

Ref article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGuard-updates-using-a-proxy-server/ta...

Thank you,

saleha