Troubleshooting Tip: Connection to Firmware Update server

[btey]

Description
This article describes how to troubleshoot/verify the connection from FortiGate to Firmware Update server.

Solution
1) Ensure firewall can resolve IP address for hostname globalupdate.fortinet.net.

# execute ping globalupdate.fortinet.net

2) Use the following command to capture the debug log:

# diagnose debug disable
# diagnose debug reset
# diagnose debug application forticldd
# diagnose debug enable

Once the debug is enabled, it will be possible to access to System -> Firmware and execute 'Backup config and upgrade'.

The sample debug output as below:

[483] fds_https_connect: https_connect(96.45.33.85:443) is established.
[288] fds_svr_default_on_established: fdni has connected to ip=96.45.33.85:443
[295] fds_svr_default_on_established: server-fdni handles cmd-2
[1314] img_untar_req: image=[06004000FIMG0013704005], outfile=[/tmp/fdsm.out]
[128] fds_pack_objects: number of objects: 1
[98] fds_print_msg: FCPC: len=133
[105] fds_print_msg: Protocol=2.0
[105] fds_print_msg: Command=SelectiveUpdate
[105] fds_print_msg: Firmware=FGVMK6-FW-6.04-1803
[105] fds_print_msg: SerialNumber=FGVMXXXXXXXXXX
[105] fds_print_msg: DataItem=06004000FIMG0013704005
[98] fds_print_msg: http req: len=260
[105] fds_print_msg: POST https://96.45.33.85:443/FCPService/FirmwareUpgrade HTTP/1.1
[105] fds_print_msg: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
[105] fds_print_msg: Host: 96.45.33.85:443
[105] fds_print_msg: Cache-Control: no-cache
[105] fds_print_msg: Connection: close
[105] fds_print_msg: Content-Type: application/octet-stream
[105] fds_print_msg: Content-Length: 325
[487] fds_https_connect: http request to 96.45.33.85:443: header=260, ext=325.
[227] fds_https_send: sent 260 bytes: pos=0, len=260

Check on the debug log if there any issue during the download process.

Example:

[465] fds_send_reply: Sending 4 bytes data.
[489] fds_send_reply: send reply failed: req-2, Connection refused
[203] __ssl_data_ctx_free: Done
[1046] ssl_free: Done
[195] __ssl_cert_ctx_free: Done
[1056] ssl_ctx_free: Done
[1037] ssl_disconnect: Shutdown
[421] fds_free_tsk: cmd=2; req.noreply=1