Allow FortiGuard services and updates to initiate from a traffic VDOM

In multi VDOM mode, users can choose from which VDOM FortiGuard services and updates are initiated from, instead of being locked to the management VDOM. This allows deployment scenarios where the management VDOM is a closed network.

When the management VDOM is a closed network, it does not have internet access. However, FortiGuard services (FortiGuard updates, web filters, DNS proxy, DDNS, and so on) can be configured if a traffic VDOM is used as the root VDOM.

To configure FortiGuard services on a traffic VDOM:

1. Set up a traffic VDOM for FortiGuard services:

   config global
       config system fortiguard
           set vdom "root"
       end
   end

2. Ensure the traffic VDOM has the correct gateway to reach the internet:

   config vdom
       edit root
           config router static
               edit 1
                   set gateway 172.16.200.254
                   set device "wan1"
               next
           end
       next
   end

3. Configure the DNS servers to ensure the FortiGuard services can resolve the server name through the traffic VDOM:

   config vdom
       edit root
           config system vdom-dns
               set vdom-dns enable
               set primary 208.91.112.53
               set secondary 208.91.112.52
           end
       next
   end