As the server override mode is strict, there is no fallback. FMG will communicate only with server configure in override server list.

The most likely reason FortiGate HQ-NGFW-1 does not recognize the new IPS signature is that FortiManager and FortiGate have different IPS database versions. The FortiManager may have pushed a signature update that FortiGate has not yet synchronized or validated locally, causing the signature to be unrecognized.

You can configure the FortiManger NATed IP address on FortiGate under the central management configuration. This allows FortiGate to announce itself to FortiManager and try to re- establish the FGFM tunnel, if it is torn down. Configuring the FortiManager NATed IP address on FortiGate allows both FortiManager and FortiGate to re-establish the FGFM tunnel. Also, if you configure the FortiManager NATed IP address under the FortiManager system administrator settings, FortiManager sets this address on FortiGate during the discovery process.

The configuration includes a server-list with server-type set to "update rating," which enables FortiGate HQ-NGFW-1 to contact FortiManager as a FortiGuard Distribution Server (FDS) for FortiGuard updates.
The installation includes a root_CA3 certificate, which FortiManager will install on FortiGate HQ- NGFW-1 to authenticate FGFM tunnel connections between the devices.