does the wildcard fqnd *.fortinet.com includes all the ip of fortiguard?

[WQ]

hi, we have installed a new fortinet firewall, now need to create a firewall rule for connection this firewall to fortiguard for licensing, database update. Can anyone pls advise the full ip list of fortiguard? does the wildcard fqnd *.fortinet.com includes all the IP of fortinet? Thanks in advance. 

[kaman]

Hello WQ,

I hope you are doing well!

To create a firewall rule for the FortiGate firewall to connect to FortiGuard for licensing and database updates, you do not need to specify the full IP list of FortiGuard.
Using the wildcard FQDN "*.fortinet.com" should cover the necessary IP addresses for FortiGuard services.

The wildcard FQDN "*.fortinet.com" includes multiple IP addresses associated with FortiGuard services. The FortiGate will resolve these IP addresses dynamically as needed for communication with FortiGuard servers. This approach simplifies the configuration and ensures that the FortiGate can reach the required FortiGuard services without manually specifying each IP address.

By using the wildcard FQDN "*.fortinet.com" in your firewall rule, you allow the FortiGate to dynamically resolve and connect to the appropriate FortiGuard IP addresses as required for licensing and database updates.

Please refer to the below document for more information:
https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/217973/using-wildcard-fqdn-a...

[WQ]

Hi Kaman,

Thanks a lot for your kind advice! I tried to use wildcard FQDN *.fortinet.com as destination, but the traffics to fortiguard didn't hit this rule. Can you pls advise the possible causes? Thanks in advance! our dns server should be able to reach outside dns. 

[funkylicious]

Hi,
An alternative would be to use the ISBD objects, which should include the FortiGuard servers , in the firewall rule.

[kaman]

When using a wildcard FQDN like *.fortinet.com as a destination in a firewall policy, and the traffic to FortiGuard doesn't hit this rule, you can troubleshoot the issue by following these steps:
1. Verify the configuration: Double-check the firewall policy configuration to ensure that the wildcard FQDN *.fortinet.com is correctly specified as the destination.
2. Check DNS resolution: Confirm that the FortiGate firewall can resolve the wildcard FQDN *.fortinet.com to the correct IP addresses. You can use the CLI command `diagnose firewall fqdn list` to check if the FQDN is resolving properly.
3. Check routing: Ensure that the traffic destined for FortiGuard is correctly routed through the firewall policy where the wildcard FQDN is specified as the destination.
4. Monitor traffic: Use the FortiGate GUI or CLI to monitor the traffic hitting the firewall policies and check if the traffic to FortiGuard is matching the policy with the wildcard FQDN destination.
5. Verify logs: Check the firewall logs for any indications of why the traffic to FortiGuard is not hitting the expected rule with the wildcard FQDN destination.
6. **Check DNS Resolution**: Ensure that your DNS server can resolve the wildcard FQDN *.fortinet.com to an IP address. If the DNS server cannot provide results, the FortiGate will not match the traffic to the wildcard FQDN rule.
7. **Session Helper Configuration**: Verify that the UDP DNS session helper is enabled on your FortiGate. Without this helper, DNS resolution may not be performed correctly, causing the traffic not to match the wildcard FQDN rule. You can configure the dns-udp session helper by following these steps: ```
config system session-helper
edit 14
set name dns-udp
set protocol 17
set port 53
next
end