Technical Tip: How to allow Windows update blocked by FortiGate

[ap]

Description	It is possible that FortiGate might block Windows updates due to security profile inspection by an Antivirus profile, Web Filter profile, or Application control profile. This article describes how to allow only Windows updates without making any changes to existing security profiles.
Scope	FortiGate, Windows update.
Solution	Create a firewall policy with 'Microsoft-Microsoft.Update' ISDB (Internet service database) as a destination in firewall policy without any security profile applied. Move it to the top above all firewall policies (or above the firewall policy that blocks Windows updates): After configuring the firewall policy as above, retry Windows updates and it will be successful.