Technical Tip: Connectivity to link-local IP 169.254.169.254 from FortiGate VM on public cloud (AWS)

The issue occurs when the FortiGate VM cannot reach AWS IMDS (Instance Metadata Service) during the instance validation stage, preventing the license validation stage from proceeding. As FortiGate-VM license validation behavior was changed starting from the v7.4.10, v7.6.7, and v8.0.0 versions, it must complete instance validation using AWS IMDS before performing license activation.

To verify instance metadata before progressing to the license validation step, the FortiGate queries IMDSv2 to the link-local address 169.254.169.254. As part of the updated workflow, if FortiGate VM fails to reach IMDS due to missing routes, AWS Security Group rules, subnet ACLs, or VPC configuration, the FortiGate VM remains in the instance validation stage, repeatedly retrying until the timeout is reached.

System status:

FGVM-AWS # get system status
Version: FortiGate-VM64-AWS v7.4.11,build2878,260126 (GA.M)
First GA patch build date: 230509

(..skip..)

Serial-Number: FGVMSLTM00000000
License Status: Startup
License Expiration Date: 2027-02-04
VM Resources: 1 CPU/4 allowed, 3847 MB RAM
Log hard disk: Available
Hostname: FGVM-AWS
Private Encryption: Disable
Operation Mode: NAT
Current virtual domain: root

Cloudinitd debug:

Failed to request imdsv2 token:28, retry sequence 1
Failed to request imdsv2 token:28, retry sequence 2
Failed to request imdsv2 token:28, retry sequence 3
Failed to request imdsv2 token:28, retry sequence 4
Failed to request imdsv2 token:28, retry sequence 5
Failed to request imdsv2 token:28, retry sequence 6
(..skip..)

The cloudinitd debug confirms that the FortiGate VM is unable to reach AWS IMDS at 169.254.169.254, causing the system to remain stuck in license initialization. Only after a successful IMDS query can the system proceed to license validation.

Therefore, a user needs to ensure that FortiGate VM has a route to 169.254.169.254 and can reach the AWS IMDS service through the correct ENI gateway.

config router static

    edit 3

        set dst 169.254.169.254 255.255.255.255

        set gateway <gateway>

        set device <interface>

    next

end

The issue will be fixed in the following versions (not scheduled yet).

Related article:
Technical Tip: Connectivity to link-local IP 169.254.169.254 from FortiGate VM on public cloud (Azure)