Troubleshooting Tip: The product serial number has already been registered: FortiManager/FortiAnalyzer

Description

This article describes how to resolve an issue while setting up FortiManager/FortiAnalyzer where, during login, the user is prompted to register even though the user has already registered on the Support Portal. Trying to register again results in the error:

The product serial number has already been registered

Scope

FortiManager and FortiAnalyzer.

Solution

The terminology used in this document: 'FDS' = FortiGate AV/IPS.

Troubleshooting:

This issue arises when the FortiManager/FortiAnalyzer is already registered on the FortiCare Support Portal but is not able to reach the FortiGuard servers to verify the registration information.

1. Check if FortiManager/FortiAnalyzer is connected to the internet to communicate with the FortiGuard server.
   Access FortiManager via SSH/console and try:
   
   

execute ping usfds1.fortinet.com

2. Check if the FortiManager/FortiAnalyzer is getting the FortiGuard server's IP address:
   
   

diagnose fmupdate view-serverlist fds

3. Check the FDS logs:
   
   

diagnose fmupdate view-linkd-log fds

Logs for an FDS connection error:

Resolution:

4. Make sure to allow port 443 communication to the following domains:

   • usforticlient.fortinet.net.

   • forticlient.fortinet.net.

   • usfds1.fortinet.com.

   • fds1.fortinet.com.

     • Or a wildcard FQDN *.fortinet.com and *.fortinet.net.

     • Or use the Internet Services object 'Fortinet-FortiGuard' on the edge of FortiGate. See Technical Tip: How to get FortiGuard server IP and connect port.

   • In case FortiManager/FortiAnalyzer is using a web-proxy, make sure the proxy config is correct; otherwise, disable the web-proxy:
     
     

config system web-proxy
    set status disable
end

5. Restart the FDS service from the FortiManager/FortiAnalyzer CLI:
   
   

diagnose fmupdate service-restart fds

6. Check the FortiGuard server's IP address again. It should show multiple IP addresses:
   
   

diagnose fmupdate view-serverlist fds

7. Check the FDS logs again. This time the communication should be successful:
   
   

diagnose fmupdate view-linkd-log fds

8. Change the USG configuration and check the FortiGuard server's IP address again:
   
   

config system global
    usg disable
end

9. Try logging into FortiManager/FortiAnalyzer again and rebooting the FortiManager/FortiAnalyzer. Registration should not be requested this time. If it still shows the error, wait for a few minutes:
   
   

Note:

This is also useful in cases where a license is added/renewed for FortiManager/FortiAnalyzer but is not reflected on the device due to a FortiGuard communication error.

Additionally, FortiAnalyzer may throw the following error while upgrading it:

This FortiAnalyzer does not have a valid Firmware Contract for upgrading/downgrading to another major/minor version

If this occurs, contact Fortinet Support and provide them with a TAC report CLI output as well as the output of the above diagnose command.

execute tac report

Related articles:

Technical Tip: Verifying FortiGuard connectivity on FortiManager

Technical Tip: How to get FortiGuard server IP and connect port

Troubleshooting Tip: Resolving a FortiCare and SSO pop-up error with FortiManager registration