Using Mgmt interfaces for fortiguard servers updates

[Netadmin-ccl-org]

Since you cannot have two default routes with two different source interfaces...I hate that. How do I get my mgmt interfaces to be used to contact fortinet servers? Is there a range of destination IPs that I can set statics to via the mgmt interface?

[AEK]

You can specify as follows.

config system fortiguard
  set interface-select-method specify
  set interface mgmt
  set source-ip x.x.x.x

[Netadmin-ccl-org]

But without a default route tied to the mgmt interface how does it know where to go?

[AEK]

Oh so you have SD-WAN?

Your solution then is to set mgmt interface as dedicated to management. The condition is to have no firewall policy with mgmt as source interface or destination interface.

config system interface
  edit "mgmt"
    set dedicated-to management

You will then be able to add default route through mgmt interface.

[Netadmin-ccl-org]

Already have the mgmt interface set to dedicated to mgmt. I do not have any policies at all at this point tied to mgmt but it does not let me add static default route. 

[Netadmin-ccl-org]

Says you cannot have duplicate routes on sdwan and non sdwan interface.

[AEK]

Ok I admit I was wrong.

So your solution is to add a route to "Internet Service" > FortiGuard, via mgmt.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-a-static-route-for-Predefined-Int...

[Netadmin-ccl-org]

This does not seem to fix my fortigates not being able to talk to the fortiguard servers over my mgmt network.

[AEK]

So I summarize..

You forced FortiGuard local-out-routing through mgmt, like this:

config system fortiguard
  set interface-select-method specify
  set interface mgmt
  set source-ip x.x.x.x

And you added a route towards "Internet Service" > FortiGuard, via mgmt through the gateway in front of mgmt.

Right?

So now you need to check with "diag sniffer" from where the FortiGuard traffic is flowing. You can run "exec update now" to generate traffic with FortiGuard.