Connecting to FortiGuard services

After the FortiMail unit is physically installed and configured to operate in your network, if you have subscribed to FortiGuard Antivirus and/or FortiGuard Antispam services, connect the FortiMail unit to the Fortinet Distribution Network (FDN).

Connecting your FortiMail unit to the FDN or override server ensures that your FortiMail unit can:

• download the most recent FortiGuard Antivirus and FortiGuard Antispam definitions and engine packages
• query the FDN for blacklisted servers and other real-time information during FortiGuard Antispam scans, if configured

This way, you scan email using the most up-to-date protection.

The FDN is a world-wide network of Fortinet Distribution Servers (FDS). When a FortiMail unit connects to the FDN to download FortiGuard engine and definition updates, by default, it connects to the nearest FDS based on the current time zone setting. You can override the FDS to which the FortiMail unit connects.

Your FortiMail unit may be able to connect using the default settings. However, you should confirm this by verifying connectivity.

You must first register the FortiMail unit with the Fortinet Technical Support web site, https://support.fortinet.com/, to receive service from the FDN. The FortiMail unit must also have a valid Fortinet Technical Support contract which includes service subscriptions, and be able to connect to the FDN or the FDS that you will configure to override the default FDS addresses. For port numbers required for license validation and update connections, see the FortiMail Administration Guide.

Before performing the next procedure, if your FortiMail unit connects to the Internet using a proxy, use the CLI command config system fortiguard antivirus to enable the FortiMail unit to connect to the FDN through the proxy. For more information, see the FortiMail CLI Reference.

To override the default FDS server

1. Go to Maintenance > FortiGuard > Update in the advanced mode of the web UI.
2. In the FortiGuard Update Options area, select Use override server address,
3. Enter the fully qualified domain name (FQDN) or IP address of the FDS.
4. Click Apply.
5. Click Refresh.

A dialog appears, notifying you that the process could take a few minutes.

The FortiMail unit tests the connection to the FDN and, if any, the override server. Time required varies by the speed of the FortiMail unit’s network connection, and the number of timeouts that occur before the connection attempt is successful or the FortiMail unit determines that it cannot connect. When the connection test completes, the page refreshes. Test results are displayed in the FortiGuard Distribution Network field.

• Available: The FortiMail unit successfully connected to the FDN or override server.
• Not available: The FortiMail unit could not connect to the FDN or override server, and will not be able to download updates from it. For CLI commands that may be able to assist you in troubleshooting, see “To verify rating query connectivity” on page 46.

6. When successful connectivity has been verified, continue by configuring the FortiMail unit to receive engine and definition updates from the FDN or the override server using one or more of the following methods:
   • scheduled updates (see “Configuring scheduled updates” on page 47)
   • push updates (see “Configuring push updates” on page 48)
   • manually initiated updates (see “Manually requesting updates” on page 49)
7. Click Apply to save your settings.

To verify rating query connectivity

1. Go to Maintenance > FortiGuard > AntiSpam in the advanced mode of the web UI.
2. Make sure the Enable Service check box is marked. If it is not, mark it and click Apply.

If the FortiMail unit can reach the DNS server, but cannot successfully resolve the domain name of the FDS, a message appears notifying you that a DNS error has occurred.

Figure 5: DNS error when resolving the FortiGuard Antispam domain name

Verify that the DNS servers contain A records to resolve service.fortiguard.net and other FDN servers. You may be able to obtain additional insight into the cause of the query failure by manually performing a DNS query from the FortiMail unit using the following CLI command:

execute nslookup name service.fortiguard.net

If the FortiMail unit cannot successfully connect, or if your FortiGuard Antispam license does not exist or is expired, a message appears notifying you that a connection error has occurred.

Figure 6: Connection error when verifying FortiGuard Antispam rating query connectivity

Verify that:

• your FortiGuard Antispam license is valid and currently active
• the default route (located in System > Network > Routing) is correctly configured
• the FortiMail unit can connect to the DNS servers you configured during the Quick Start Wizard (located in System > Network > DNS), and to the FDN servers
• firewalls between the FortiMail unit and the Internet or override server allow FDN traffic (For configuration examples specific to your operation mode, see “Gateway mode deployment” on page 50, “Transparent mode deployment” on page 78, or “Server mode deployment” on page 101.)

Obtain additional insight into the point of the connection failure by tracing the connection using the following CLI command:

execute traceroute <address_ipv4> where <address_ipv4> is the IP address of the DNS server or FDN server.

When query connectivity is successful, antispam profiles can use the FortiGuard-AntiSpam scan option.

If FortiGuard Antispam scanning is enabled, you can use the antispam log to analyze any query connectivity interruptions caused because FortiMail cannot connect to the FDN and/or its license is not valid. To enable the antispam log, go to Log and Report > Log Settings > Local Log Settings in the advanced mode of the web UI. To view the antispam log, go to Monitor > Log > AntiSpam, then mark the check box of a log file and click View.

If FortiMail cannot connect with the FDN server, the log Message field contains:

FortiGuard-Antispam: No Answer from server.

Verify that the FortiGuard Antispam license is still valid, and that network connectivity has not been disrupted for UDP port 53 traffic from the FortiMail unit to the Internet.

Configuring scheduled updates

You can configure the FortiMail unit to periodically request FortiGuard Antivirus and FortiGuard Antispam engine and definition updates from the FDN or override server.

You can use push updates or manually initiate updates as alternatives or in conjunction with scheduled updates. If protection from the latest viral threats is a high priority, you could configure both scheduled updates and push updates, using scheduled updates as a failover method to increase the likelihood that the FortiMail unit will still periodically retrieve updates if connectivity is interrupted during a push notification. While using only scheduled updates could potentially leave your network vulnerable to a new virus, it minimizes short disruptions to antivirus scans that can occur if the FortiMail unit applies push updates during peak volume times. For additional/alternative update methods, see “Configuring push updates” on page 48 and “Manually requesting updates” on page 49.

For example, you might schedule updates every night at 2 AM or weekly on Sunday, when email traffic volume is light.

Before configuring scheduled updates, first verify that the FortiMail unit can connect to the FDN or override server. For details, see “To override the default FDS server” on page 45.

To configure scheduled updates

1. Go to Maintenance > FortiGuard > Update in the advanced mode of the web UI.
2. Enable Scheduled Update.
3. Select one of the following:

Every	Select to request updates once per interval, then configure the number of hours and minutes between each request.
Daily	Select to request updates once a day, then configure the time of day.
Weekly	Select to request updates once a week, then configure the day of the week and the time of day.

Updating FortiGuard Antivirus definitions can cause a short disruption in traffic currently being scanned while the FortiMail unit applies the new signature database. To minimize disruptions, update when traffic is light, such as during the night.

4. Click Apply.

The FortiMail unit starts the next scheduled update according to the configured update schedule. If you have enabled logging, when the FortiMail unit requests a scheduled update, the event is recorded in the event log.

Configuring push updates

You can configure the FortiMail unit to receive push updates from the FDN or override server.

When push updates are configured, the FortiMail unit first notifies the FDN of its IP address, or the IP address and port number override. (If your FortiMail unit’s IP address changes, including if it is configured with DHCP, the FortiMail unit automatically notifies the FDN of the new IP address.) As soon as new FortiGuard Antivirus and FortiGuard Antispam packages become available, the FDN sends an update availability notification to that IP address and port number. Within 60 seconds, the FortiMail unit then requests the package update as if it were a scheduled or manually initiated update.

You can use scheduled updates or manually initiate updates as alternatives or in conjunction with push updates. If protection from the latest viral threats is a high priority, you could configure both scheduled updates and push updates, using scheduled updates as a failover method to increase the likelihood that the FortiMail unit will still periodically retrieve updates if connectivity is interrupted during a push notification. Using push updates, however, can potentially cause short disruptions to antivirus scans that can occur if the FortiMail unit applies push updates during peak volume times. For additional/alternative update methods, see “Configuring scheduled updates” on page 47 and “Manually requesting updates” on page 49.

Before configuring push updates, first verify that the FortiMail unit can connect to the FDN or override server. For details, see “To override the default FDS server” on page 45.

To configure push updates

1. Go to Maintenance > FortiGuard > Update in the advanced mode of the web UI.
2. Enable Allow push update.
3. If the FortiMail unit is behind a firewall or router performing NAT, enable Use override push IP and enter the external IP address and port number of the NAT device.

You must also configure the NAT device with port forwarding or a virtual IP to forward push notifications (UDP port 9443) to the FortiMail unit.

For example, if the FortiMail unit is behind a FortiGate unit, configure the FortiGate unit with a virtual IP that forwards push notifications from its external network interface to the private network IP address of the FortiMail unit. Then, on the FortiMail unit, configure Use override push IP with the IP address and port number of that virtual IP. For details on configuring virtual IPs and/or port forwarding, see the documentation for the NAT device.

Push updates require that the external IP address of the NAT device is not dynamic (such as an IP address automatically configured using DHCP). If dynamic, when the IP address changes, the override push IP will become out-of-date, causing subsequent push updates to fail.

If you do not enable Use override push IP, the FDN will send push notifications to the IP address of the FortiMail unit, which must be a public network IP address routable from the Internet.

4. Click Apply.

The FortiMail unit notifies the FDN of its IP address or, if configured, the override push IP. When an update is available, the FDN will send push notifications to this IP address and port number.

5. Click Refresh.

A dialog appears, notifying you that the process could take a few minutes.

The FDN tests the connection to the FortiMail unit. Time required varies by the speed of the FortiMail unit’s network connection, and the number of timeouts that occur before the connection attempt is successful or the FortiMail unit determines that it cannot connect. When the connection test completes, the page refreshes. Test results are displayed in the Push Update field.

• Available: The FDN successfully connected to the FortiMail unit.
• Not available: The FDN could not connect to the FortiMail unit, and will not be able to send push notifications to it. Verify that intermediary firewalls and routers do not block push notification traffic (UDP port 9443). If the FortiMail unit is behind a NAT device, verify that you have enabled and configured Use override push IP, and that the NAT device is configured to forward push notifications to the FortiMail unit.

Manually requesting updates

You can manually trigger the FortiMail unit to connect to the FDN or override server to request available updates for its FortiGuard Antivirus and FortiGuard Antispam packages.

You can manually initiate updates as an alternative or in addition to other update methods. For details, see “Configuring push updates” on page 48 and “Configuring scheduled updates” on page 47.

To manually request updates

Before manually initiating an update, first verify that the FortiMail unit can connect to the FDN or override server. For details, see “To override the default FDS server” on page 45.

1. Go to Maintenance > FortiGuard > Update in the advanced mode of the web UI.
2. Click Update Now.

Updating FortiGuard Antivirus definitions can cause a short disruption in traffic currently being scanned while the FortiMail unit applies the new signature database. To minimize disruptions, update when traffic is light, such as during the night.

The web UI displays a message similar to the following:

Your update request has been sent. Your database will be updated in a few minutes. Please check your update page for the status of the update.

3. Click RETURN.
4. After a few minutes, select the Update tab to refresh the page, or go to Monitor > System Status > Status.

If an update was available, new version numbers appear for the packages that were updated. If you have enabled logging, messages are recorded to the event log indicating whether the update was successful or not.