Using FortiManager as a local FortiGuard server
FortiManager can provide a local FortiGuard server with port 443 access.
Anycast FortiGuard settings force the rating process to use port 443, even with an override server. Using a unique address in the same subnet as the FortiManager access IP address, the FortiManager can provide local FortiGuard updates and rating access with a dedicated IP address and port 443.
To use a FortiManager as a local FortiGuard server:
config system central-management set type fortimanager set fmg "172.18.37.148" config server-list edit 1 set server-type update set server-address 172.18.37.150 next edit 2 set server-type rating set server-address 172.18.37.149 next end set fmg-update-port 443 set include-default-servers enable end
fmg-update-port is set to
443, the update process will use port 443 to connect to the override update server, which is the local FortiGuard server in the FortiManager. If this is not set, the update process will use port 8890, and the server address setting has to be the FortiManager access IP address. Override FortiGuard services come from the server list that is the local FortiGuard server in the FortiManager, and use the traditional, non-OCSP TLS handshake. If override servers in the FortiManager are not available, the default FortiGuard servers are connected, and the anycast OCSP TLS handshake is used.