Technical Tip: Error: 'No valid token found', impossible to provision FortiTokens in HA environment

Description

This article describes how to provision FortiTokens to users in the HA environment. When provisioning, the FortiTokens will throw an error, 'No Valid token found'.

Scope

FortiGate, FortiToken.

Solution

• In the case of setting up a High Availability (HA) cluster with multiple FortiGate/FortiAuthenticators, it is necessary to register and apply any FortiToken Mobile licenses to the primary unit.

• Check first in the support portal which FortiGate (Primary/Secondary) is the token license assigned to (for mobile tokens), or where the FortiTokens are registered (for hardware tokens).

• HA clusters of 2 units that share a single license (vSN / Virtual Serial Number) are entitled to Trial FortiTokens from FortiOS versions 7.2.12, 7.4.9, 7.6.5, 8.0.0 onward only. FortiToken Mobile licenses are supported from the same versions onward, but only for FortiToken Mobile licenses shipped after 4th of August 2025.

It is possible to check this by following the method:

1. If it is a Trial Token.

Delete the Trial Token -> Re-import Free Trial Token under User & Authentication -> FortiTokens, and it will work fine.

To delete the trial FortiToken in the CLI:

config user fortitoken 
    delete <fortitoken_serial_number> 
end 

To import trial tokens in the CLI:

execute fortitoken-mobile import 0000-0000-0000-0000-0000

2. Log in to Support.
                                        
   

   

3. Select products and then select the correct serial number for the FortiGate.
   

4. Check under the License and Key section, where FortiToken License information will be available. If it is not available, it is not registered with this unit. Check the other units.

• Once the registered unit is confirmed with FortiToken, make sure the FortiGate is in the Primary state in the HA environment. Only after that is it possible to provision FortiTokens.

• It is not possible to provision a FortiToken from an unregistered FortiGate.

• Once the provision of the FortiToken is completed, if the failover happens, there will not be any effect/outage for existing users.

• In an HA environment, the FortiToken assignment will not be impacted if a failover is triggered. It would still be the best practice to ensure that FortiToken Mobile licenses are registered with the Primary serial number.

If the issue is detected in FortiOS v7.4.9 and v7.6.5, check the following article:
Technical Tip: FortiToken Mobile cannot be provisioned on a FortiGate in v7.4.9 and v7.6.5

Troubleshooting:

Run the following command to collect the debug log for the 'Error message: "no valid token found"'.

diagnose debug console timestamp enable        
diagnose fortitoken debug enable
diagnose debug enable 

diagnose debug disable  

Use this command to stop the debug.