From the Deployment and System Settings lesson, the Study Guide states:

" The test-network command checks FortiGuard services as its last set of validation tests. These include the FortiGuard distribution network (FDN) accessibility, FDN contract expiration, web filtering service, and the community cloud service. All these FortiGuard services should be reachable and valid for FortiSandbox to be effective. "

" The diagnose-debug fdn command provides details around FortiSandbox and the FortiGuard Distribution Network (FDN) communication and updates. "

FortiGuard Distribution Network (FDN) communication requires TCP/443 for HTTPS-based update and licensing communication. The current firewall rules allow TCP/4443 (API/management), UDP/8888 (FortiGuard queries), and UDP/53 (DNS), but TCP/443 is missing — which is the standard port required for FortiGuard FDN connectivity and license validation.