Operating as an FDS in a closed network

The FortiManager can be operated as a local FDS server when it is in a closed network with no internet connectivity.

Without a connection to a FortiGuard server, update packages and licenses must be manually downloaded from the Fortinet Support portal, and then uploaded to the FortiManager.

Example topology

In the topology example below, FortiManager is operating in a closed network without access to the FortiGuard Distribution Server (FDS), and is acting as the FDS for managed FortiGate devices. Update packages, license files and metadata files are downloaded from the Fortinet Support portal and an online FortiManager, and then uploaded to the air-gapped FortiManager.

To use FortiManager as FDS in a closed network:

1. On FortiGate, enable the update services/profiles that you require.

2. On FortiManager, go to FortiGuard > Settings to configure FortiManager as a local FDS server:

   

   Enable Communication with FortiGuard Servers	Toggle OFF to disable communication with the FortiGuard servers.
   Enable Antivirus and IPS Service	Toggle ON to enable antivirus and intrusion protection service, and select what versions for each product to support.
   Enable Web Filter Services	Toggle ON to enable web filter services. When uploaded to FortiManager, the Web Filter database is displayed.
   Enable Email Filter Services	Toggle ON to enable email filter services. When uploaded to FortiManager, the Email Filter database is displayed.

3. Download the service update package(s) that are required by your managed devices.
   

   1. Required: Download the service update package(s) that are required by your managed device from the Fortinet Support Portal. Alternatively, you can export service update packages from an online FortiManager.
      

      FortiGate only downloads service updates from FortiManager for the services/profiles that it has enabled. For more information on available services, see FortiGuard in the FortiGate Administration Guide.

   2. Optional: If your managed FortiGate devices are using features which require metadata packages (for example, IPS or Application Control ), the relevant metadata packages must also be manually imported into the FortiManager. For example, FortiGates using the Slim Extended Database will require the Signature Meta Data (IPS Slim) package. Metadata packages are not available for download through the Fortinet Support Portal; instead, they can only be exported from an online FortiManager. See Exporting packages example.

   3. Optional: FortiClient EMS receives AntiVirus, Web Filter, Application Firewall, Vulnerability Scan, and Sandbox signatures and engines updates from FortiManager and deploys the updates to FortiClient while in an air-gapped or isolated network. You can export the relevant FortiGuard packages that provide signature and engine from an online FortiManager and import them on the offline FortiManager.

      Online FortiManager devices used to export packages must include a valid license.

4. Go to FortiGuard > Settings and upload the service update packages:

   Upload Options for FortiGate/FortiMail (and FortiSOAR)
   Packages and Database	Select to upload antivirus and IPS packages, web filter databases, and email filter databases. Browse for the file you downloaded from the Fortinet Support portal on your management computer, or drag and drop the file onto the dialog box, and click OK. As databases can be large, we recommend uploading them using the CLI. See Uploading packages with the CLI.
   Service License	Select to import the FortiGate or FortiSOAR license. License files can be obtained from support by requesting your account entitlement for the device. See Requesting account entitlement files. Browse for the file you downloaded from the Fortinet Support portal on your management computer, or drag and drop the file onto the dialog box, and click OK.
   Upload Options for FortiClient
   AntiVirus/IPS Packages	Select to upload the FortiClient AntiVirus/IPS packages. Browse for the file you downloaded from the Fortinet Support portal on your management computer, or drag and drop the file onto the dialog box, and click OK.

Uploading packages with the CLI

Packages and licenses can be uploaded using the CLI. This should be used when the packages being uploaded are large, like database packages.

To upload packages and license files using the CLI:

1. If not already done, disable communications with the FortiGuard server and enable a closed network with the following CLI commands:

   config fmupdate publicnetwork

   set status disable

   end

2. Upload an update package or license:
   1. Load the package or license file to an FTP, SCP, or TFTP server
   2. Run the following CLI command:

      execute fmupdate {ftp | scp | tftp} import <av-ips | fct-av | url | spam | file-query | license-fgt | license-fct | custom-url | domp> <remote_file> <ip> <port> <remote_path> <user> <password>