A real-life situation
Northgate Dental Group, a fictional company, runs one FortiGate at each of its eight clinics. One morning the clinic in Riverside reports that staff can reach websites that are normally blocked, while another clinic sees "rating error" pages on harmless sites. Nothing in the firewall policies has changed. The cause is outside the policy table: one FortiGate's FortiGuard subscription expired last week, and at the other clinic a DNS change means the FortiGate can no longer reach the FortiGuard rating servers.
An administrator who knows how FortiOS and FortiGuard fit together finds both problems in minutes, with three commands: get system status, diagnose autoupdate versions and diagnose debug rating. This lesson explains what sits behind those commands.
One operating system on every platform
FortiOS is the operating system on every FortiGate. The same release, with the same GUI, CLI and configuration syntax, runs on very different platforms:
| Platform | Typical use | What is different |
|---|---|---|
| Desktop appliance | Small office, branch, clinic | Few ports, often a built-in LAN switch; usually a system-on-a-chip (SoC) that combines CPU and security processors |
| Mid-range and high-end appliance | Campus edge, data centre | More and faster ports, separate network and content processors |
| FortiGate VM | Private cloud, labs, hypervisors (VMware, KVM, Hyper-V) | No security processors: the fast path runs in software on vCPUs |
| Public cloud instance | AWS, Azure, Google Cloud and others | A VM image plus cloud integration (cloud routing, load balancers, metadata) |
Because the operating system is the same, a skill learned on a FortiGate VM in a lab carries over to a hardware unit in production. What changes between platforms is capacity and hardware acceleration, not the way you configure the firewall.
How FortiOS is built: management plane and data plane
It helps to split FortiOS into two halves. The management plane is everything that manages the firewall itself. The data plane is everything that handles the traffic passing through it.
| Management plane | Data plane | |
|---|---|---|
| Job | Run the firewall: administration, logging, updates, routing protocols | Forward, translate and inspect traffic |
| Runs on | The CPU | The CPU (kernel and inspection engines) plus network and content processors where present |
| Examples | Web GUI, SSH and console CLI, the configuration database, FortiGuard update and log daemons | Session table, routing and policy lookups, NAT, IPS engine, proxies, offloaded sessions |
| When it struggles | Slow GUI, delayed logs, failed updates | Dropped packets, latency, sessions not created |
The CPU, the kernel and the daemons
On the CPU, the FortiOS kernel handles the first packet of every session: the session lookup, routing, policy match and NAT described in the packet flow lesson. Around the kernel run many separate processes, called daemons, each with one job. You see them by name in diagnose sys top. Names you will commonly meet include:
ipsengine: the IPS engine, which does flow-based inspection (IPS, application control and flow-based antivirus and web filtering).wad: the proxy daemon used for proxy-based inspection and explicit web proxy.miglogd: logging.httpsd: the web GUI.cmdbsvr: the configuration database server.updatedandurlfilter: FortiGuard updates and rating lookups.
Exact daemon names and how many instances run depend on the model and release. The useful idea is that a busy daemon points at one feature: a high ipsengine load points at flow inspection, a high wad load at proxy inspection.
diagnose sys top 5 20Lists the busiest processes, refreshed every 5 seconds, showing up to 20 lines. Press q to quit. Use it to see which daemon is consuming CPU or memory.
Security processors: offloading the data plane
Most hardware FortiGates add Fortinet's own chips to the data plane. Network processors (NPs) forward established sessions without CPU work. Content processors (CPs) help the CPU with encryption and some inspection tasks. Desktop models often combine these functions with the CPU in one SoC. The CPU still handles the first packets of each session and everything in the management plane; the processors take the repetitive work.
Learn more: Security Processors and Hardware Acceleration
The configuration model
FortiOS keeps its whole configuration in one configuration database, organised as tables (interfaces, policies, addresses, VPNs and so on). The GUI, the CLI, FortiManager and the REST API all read and write that same database, so a change made in one place is visible in the others straight away.
- Changes apply immediately. When you leave an entry with
nextor a table withend, or click OK in the GUI, the change takes effect and, by default, is saved to flash. - No running and startup configuration. Unlike Cisco IOS, there is no second copy to save, so a reboot keeps your changes, and also keeps your mistakes.
- show prints configuration (non-default settings, in the form you would type them); get prints current values and status.
show system dns
get system statusshow system dns prints the DNS configuration as CLI commands. get system status prints live information: firmware version, serial number, database versions, operation mode and HA state.
Learn more: The FortiOS CLI
VDOMs: several firewalls in one
A virtual domain (VDOM) is an independent virtual firewall inside one FortiGate. Each VDOM has its own interfaces, routing table, firewall policies, security profiles, VPNs and, if you want, its own administrators. Traffic can't pass from one VDOM to another unless you connect them on purpose.
- No VDOMs (the default). A new FortiGate has a single VDOM called
root, and the GUI hides VDOM settings. - Multi-VDOM mode. You create more VDOMs and assign each interface to one VDOM. The GUI gains a global view (hardware, firmware, HA, administrators) and a per-VDOM view (policies, routing, profiles).
- Management (admin) VDOM. One VDOM,
rootby default, is used by the FortiGate's own traffic: FortiGuard updates, logging to FortiAnalyzer, NTP and DNS. It needs a working route to the Internet or to your management servers. - Inter-VDOM links. A pair of virtual interfaces that joins two VDOMs, configured under
config system vdom-link. Traffic crossing the link is checked by policies in both VDOMs. Some models with network processors also offer NP-accelerated inter-VDOM links. - How many. Hardware models include a set number of VDOMs, and many larger models can be licensed for more. The number varies by model, so check the data sheet;
get system statusshows the current maximum.
config system global
set vdom-mode multi-vdom
endTurns on multi-VDOM mode. After this, the CLI starts at the global level: use config vdom, then edit <name>, to work inside a VDOM, and config global for system-wide settings.
⚠ Changing the VDOM mode reorganises the whole device
Switching VDOM mode logs out administrators, moves settings between the global and per-VDOM levels, and changes how backups, FortiManager and scripts address the configuration. Plan it, back up the configuration first, and do it in a maintenance window, not on a firewall you are managing remotely through the traffic interfaces.
vdom-mode is the setting in both 7.4 and 7.6; some models also offer a split-VDOM mode with a fixed management VDOM and one traffic VDOM. Releases before 6.4 used a different setting, so older guides may show other commands.
Operation modes: NAT and transparent, per VDOM
Each VDOM runs in one operation mode:
| NAT mode (default) | Transparent mode | |
|---|---|---|
| Forwards by | IP routing between subnets | Bridging by MAC address, like a switch |
| Interface addresses | Each interface has its own IP address | Traffic interfaces have none; one management IP for the VDOM |
| Policies and inspection | Yes | Yes |
| Fits when | The FortiGate is the gateway | You must insert a firewall without readdressing the network |
Because the mode is per VDOM, one FortiGate can route for the corporate network in one VDOM and act as a transparent bridge in front of a legacy server segment in another.
config system settings
set opmode transparent
set manageip 10.0.1.5/24
set gateway 10.0.1.1
endChanges the current VDOM to transparent mode with a management address and default gateway. In multi-VDOM mode, run it inside the VDOM (config vdom, edit <name>).
⚠ Changing the operation mode removes conflicting configuration
FortiOS can only switch modes once interface addresses, routes, VIPs and other mode-specific objects are out of the way, and the change drops the VDOM's traffic while it happens. If you are connected through an interface of that VDOM, you will lose your session. Use the console or another VDOM's management access.
Inspection modes
Two separate choices decide how a VDOM inspects traffic:
- Flow-based or proxy-based inspection, chosen per firewall policy. Flow-based inspection passes packets through the IPS engine as they flow; proxy-based inspection buffers and reassembles content in the proxy before releasing it, which allows some extra features at the cost of latency and CPU.
- Profile-based or policy-based NGFW mode, chosen per VDOM (
set ngfw-modeunderconfig system settings). Profile-based is the default: each firewall policy carries its own security profiles. Policy-based mode lets security policies match applications and URL categories directly, with SSL inspection handled by a separate policy.
Learn more: Flow-Based and Proxy-Based Inspection in the Packet Path
FortiGuard: the services behind security profiles
A security profile is only as good as the information behind it. An IPS sensor without current signatures misses new attacks; a web filter without ratings doesn't know what a URL is. FortiGuard supplies that information, produced by Fortinet's threat research team and delivered through the FortiGuard Distribution Network (FDN).
| Service | Used by | Delivered as |
|---|---|---|
| Antivirus | Antivirus profiles | Signature packages and engine updates |
| IPS | IPS sensors | Signature packages and engine updates |
| Application control | Application sensors, NGFW policies | Application signature packages |
| Web filtering | Web filter profiles (FortiGuard categories) | Live rating lookups, cached locally |
| DNS filtering | DNS filter profiles | Live domain rating lookups |
| Botnet and malicious IP/domain lists | IPS and DNS filter options | Packages (lists of known command-and-control addresses and domains) |
| Outbreak prevention | Antivirus profiles | Live hash lookups for very new malware |
| Anti-spam | Email filter profiles | Live lookups (sender reputation, spam signatures) |
| Internet Service Database | Policies that match Internet services | Packages (address ranges of well-known services) |
Fortinet adds and renames services over time, and some (such as sandboxing or IoT detection) depend on the licence you buy. The table shows the services you will meet first.
How updates and rating lookups work
FortiGuard information reaches a FortiGate in two different ways, and they fail in different ways.
The difference matters during an outage. If package updates fail, the FortiGate keeps inspecting with the databases it already has; protection slowly goes stale. If rating lookups fail, the web filter can't classify new sites at all, and each profile's rating-error setting decides whether those sites are allowed or blocked. Users notice that immediately.
Where the FortiGate connects
FortiGuard traffic is local-out traffic: it starts on the FortiGate itself, from the management VDOM, so it isn't controlled by your forward firewall policies. It does need DNS, a route, and any upstream firewall to allow it. In recent releases the FortiGate connects to FortiGuard's anycast servers over HTTPS on TCP port 443 by default. You can change the protocol and port if a network in between blocks the default:
config system fortiguard
set fortiguard-anycast enable
set protocol https
set port 443
endThe recent default: anycast servers over HTTPS on port 443. With anycast disabled, older options such as UDP on port 53 or 8888 become available for rating lookups; the choices offered depend on the release.
In the GUI
License Information
| Entitlement | Status | Version / expiry |
|---|---|---|
| Firmware & General Updates | Licensed | Expires 2027-03-13 |
| Intrusion Prevention | Licensed | IPS DB 32.0xxxx |
| AntiVirus | Licensed | AV DB 92.0xxxx |
| Web Filtering | Expired | Expired 2026-10-05 |
| Outbreak Prevention | Not licensed | – |
- Highlighted: the web filtering subscription has lapsed, so new sites can no longer be rated.
Licensing basics
- Per serial number. FortiGuard entitlements belong to one FortiGate's serial number, registered in your FortiCare account. A FortiGate VM gets its serial number from its licence file.
- Each cluster member needs its own. In an HA cluster every unit has its own serial number, so each needs matching licences.
- Bundles. Fortinet sells individual services and bundles of several. Bundle names and contents change, so read the current ordering guide rather than relying on a list you saw once.
- Firmware. Downloading firmware and receiving technical support depend on a support contract, which is separate from the security services.
What happens when a licence expires
| Service type | After expiry, in general |
|---|---|
| Firewall, routing, NAT, VPN | Unaffected: they don't depend on FortiGuard |
| Signature-based (AV, IPS, application control) | The last downloaded databases stay in use, but no new signatures arrive |
| Live lookups (web filter, DNS filter, outbreak prevention, anti-spam) | Queries are refused; the profile's rating-error handling decides what users see |
Details such as grace periods, which features are disabled outright and how expired engines are handled vary between services and releases. The FortiOS Administration Guide and the FortiGuard licensing pages for your release are the reference; this table describes the general pattern.
Verification
Start with the overview, then check updates, then check live ratings.
FGT1 # get system status Version: FortiGate-VM64 v7.6.x,buildxxxx,xxxxxx (GA) ... Virus-DB: 92.0xxxx(2026-10-12 01:07) ... IPS-DB: 32.0xxxx(2026-10-11 21:30) ... Serial-Number: FGVMxxxxxxxxxxxx ... Hostname: FGT1 Operation Mode: NAT Current virtual domain: root ... Current HA mode: standalone ... System time: Mon Oct 12 09:14:02 2026
FGT1 # diagnose autoupdate versions AV Engine --------- Version: 7.000xx signed Contract Expiry Date: Sat Mar 13 2027 Last Updated using scheduled update on Mon Oct 12 01:07:00 2026 Last Update Attempt: Mon Oct 12 09:07:00 2026 Result: No Updates ... IPS Attack Engine --------- ...
FGT1 # diagnose debug rating Locale : english Service : Web-filter Status : Enable License : Contract ... -=- Server List (Mon Oct 12 09:14:02 2026) -=- IP Weight RTT Flags TZ ... Curr Lost Total Lost 192.0.2.80 10 14 DI 0 ... 0 0 198.51.100.81 20 31 0 ... 0 2 ...
get system fortiguard-service statusSummarises the FortiGuard services and the versions of the objects the FortiGate has received. Use it alongside diagnose autoupdate versions.
execute update-nowAsks the FortiGate to check for and download updates straight away instead of waiting for the schedule. Run diagnose autoupdate versions afterwards to see the result.
What can go wrong
Database dates are weeks old
get system status shows old IPS and antivirus dates, and diagnose autoupdate versions shows failed attempts or an expiry date in the past.
Show the fix
First read the contract expiry dates. If they have passed, the fix is the licence, not the network: renew it, make sure it is registered to this serial number, then run execute update-now. If the licences are valid, treat it as a connectivity problem: check DNS, the route from the management VDOM and any upstream firewall, as in the next case.
Web filtering shows rating errors
Users see rating error pages, or the profile lets everything through, and diagnose debug rating shows an empty server list or servers with constant losses.
Show the fix
Work from the bottom up:
- DNS: can the FortiGate resolve names? Try
execute ping update.fortiguard.net; if the name doesn't resolve, fixconfig system dns. - Routing: does the management VDOM have a default route to the Internet?
- Upstream filtering: does a firewall or proxy between the FortiGate and the Internet allow HTTPS on TCP port 443 to FortiGuard? If it only allows certain ports, adjust
config system fortiguardto match. - Time: an incorrect system clock can break HTTPS connections, including to FortiGuard. Check NTP.
A failed ping only shows that ICMP got no reply; some networks block it. Use the rating server list as the real test.
Some sites are allowed that should be blocked
The web filter category for gambling is set to block, yet gambling sites open. The rating service is licensed and reachable.
Show the fix
Check the profile's rating-error handling: if "allow websites when a rating error occurs" is on, any lookup that fails (a timeout, a short outage) lets the site through. Then check that the policy matching this traffic actually has the web filter profile, and whether HTTPS sites are being inspected at all. Without SSL inspection the FortiGate can rate only the server name from the TLS handshake.
Enterprise use and design guidance
- Closed or restricted networks. A FortiGate that can't reach the Internet can get updates and ratings from a FortiManager acting as a local FortiGuard server, configured as an override server on the FortiGate. Plan this before building an isolated network, not after.
- Upstream firewalls. When the FortiGate sits behind another firewall or proxy, document FortiGuard as a required outbound flow from the FortiGate's management address.
- VDOM design. Choose the management VDOM deliberately: it carries FortiGuard, logging and NTP traffic for the whole device, so it needs reliable routing.
- Licence tracking. Track expiry dates for every serial number, including both members of each HA cluster, and alert well before they lapse.
- Mode choices. Decide on VDOMs, operation mode and NGFW mode at design time. Changing them later touches every policy.
Best practices
- After installing a FortiGate, confirm FortiGuard health before relying on any security profile.
- Check database dates during routine health checks, not only when something breaks.
- Decide, per web filter profile, whether a rating error should allow or block, and document why.
- Keep VDOM, operation-mode and inspection-mode changes to planned maintenance windows with a fresh backup.
- Use
diagnose sys topto tie high CPU to a specific daemon before changing configuration.
🛠 Practical exercise: health-check FortiGuard on a lab FortiGate
On a FortiGate VM (the evaluation licence has limited FortiGuard access, which makes the output interesting), run get system status and note the firmware version, serial number and database dates. Run diagnose autoupdate versions and write down which services show a contract and which don't. Run diagnose debug rating and explain what the server list tells you. Then break DNS on purpose by pointing config system dns at an unused address, run execute update-now, and compare the output. Restore DNS and confirm the next update succeeds.
Key takeaways
- FortiOS is one operating system on hardware, VMs and cloud; the management plane runs the device, the data plane moves and inspects traffic.
- One configuration database: changes apply when saved, with no separate startup configuration.
- VDOMs are independent virtual firewalls; each has its own operation mode and NGFW mode.
- FortiGuard delivers signature packages (used locally) and live rating lookups (needed for every new site).
- Licences belong to a serial number; on expiry, signatures stop updating and lookups stop answering.
Check yourself
A FortiGate's IPS licence expired a month ago. What is the most likely effect?
diagnose debug rating shows web filtering licensed, but the server list is empty. Where do you look first?
An administrator types end after changing an interface address. When does the change take effect?
A service provider must give two customers separate firewalls, routing tables and administrators on one FortiGate. What does it need?
diagnose sys top shows ipsengine using most of the CPU. Which feature is the likely cause?
Next in Fortinet Fundamentals, the hardware these services run on: FortiGate interfaces, management, console and HA ports.