Solution | In a usual scenario, managing and assigning the FortiToken mentioned in the above scenario would be permissible. However, Fortinet recommends registering all the FortiToken licenses to the Primary FortiGate SN for a smoother administration experience. Refer to Technical Tip: Managing FortiToken Mobile between FortiGate HA Active-Passive cluster members However, due to the issue reported in Troubleshooting Tip: Issue with mobile FortiToken assigned in FortiGate HA cluster, FortiToken assignment to users will fail if the FortiGate is running FortiOS versions 7.2.13, 7.4.9, or 7.6.5.
For FortiGate running FortiOS versions 7.4.x and 7.6.x, upgrading to FortiOS versions 7.4.10 and 7.6.7 or above resolves the issue. Therefore, this article applies only to FortiOS version 7.2.13 and explains the expected behavior when the FortiToken Mobile license is being transferred from the Secondary unit to the Primary unit.
Important notice: There is no FortiGate replacement in this scenario; the FortiGate within the HA remains the same.Â
Under this scenario, the FortiGate administrator will only need to request the transfer of the FortiToken Mobile License through the Customer Service Support Portal. The procedure would be as follows:
Schedule a maintenance window. Simultaneously with step 1, create a Customer Service ticket requesting a FortiToken Mobile license transfer from FortiGate_2 to FortiGate_1.
Include the serial number of the FortiGate and highlight the maintenance window timeframe. Once the FortiToken Mobile License is transferred from FortiGate_2 to FortiGate_1, activate the license in FortiGate_1. (No configuration changes to users or FortiToken license assignment are required). Reference: Registering FortiToken Mobile Once the FortiToken Mobile License activation is completed, the remaining unassigned FortiToken Mobile may be used for assignment as usual.
To verify if the FortiToken Mobile assignment and activation process has been completed, run the following diagnostic commands:
diagnose debug disable
diagnose debug reset
diagnose debug application forticldd -1
diagnose fortitoken debug enable
diagnose debug enable
Before the license reactivation on FortiGate_1, the administrator will not be able to assign FortiToken Mobile License 2 to any user if FortiGate_1 serves as the Primary unit. Error "no valid token found" will still be observed:
{"d"
{"__type":"SoftToken.ProvisionResponse","__version":"4","serial_number":"FGVM02TMXXXXXXXX","__device_version":"7.0","__device_build":"1762","__clustered_sns"
[{"sn":"FGVM02TMXXXXXXXX","error":null}],"tokens"
[{"token":"FTKMOBXXXXXXXXXX","license":null,"token_activation_code":null,"qr_code":null,"code_expire":null,"error"
{"error_code":31,"error_message":"token does not belong to product"}}],"result":0,"error":{"error_code":17,"error_message":"no valid token found"}}}
Keep the debug running during the reactivation of FortiToken Mobile License 2 on FortiGate_1. The FortiToken Mobile license activation is deemed successful with the output "result":2,"error":null.
{"d"
{"__type":"SoftToken.ActivationLicenseResponse","__version":"4","serial_number":"FGVM02TMXXXXXXXX","__device_version":"7.0","__device_build":"1762","__clustered_sns"
[{"sn":"FGVM02TMXXXXXXXX","error":null}],"license_activation_code":"YYYY-YYYY-YYYY-YYYY-YYYY","license":"EFTMXXXXXXXXXXXX","tokens"
[{"token":"FTKMOBXXXXXXXXXX"},..
{"token":"FTKMOBZZZZZZZZZZ"}],"result":2,"error":null}}
Provisioning and assignment of the FortiToken Mobile license beyond this point on FortiGate_1 will be successful.
In conclusion, as there are no changes on FortiGate hardware in this scenario, it is not necessary to change the configurations and reassignment of FortiToken after the license transfer. The FortiToken Mobile license that was migrated can be reactivated once the customer service agent confirms that the transfer has been completed. |
