Technical Tip: Failed to activate FortiCloud account on FortiGate. Error: 'acct_st=Error
Description
This article explains how to activate the FortiCloud account in FortiGate when encountering the error: 'acct_st=Error.'
Scope
FortiGate.
Solution
While activating a FortiCloud account on FortiGate, when encountering the following error, it indicates a potential issue with FortiCloud log settings and that the firewall is unable to reach the FortiCloud server.
FortiGate1(global) # diagnose test application forticldd 1
System=FGT Platform=FG32F1
Connection vdom: root, id=0, ha=primary.
acct_id=
acct_st=Error
FortiGuard interface selection: method=specify specify=internet-rootFortiGuard log: status=disabled, full=overwrite, ssl_opt=1, source-ip=0.0.0.0
Centra Management: type=NONE, flags=000000bf.
active-tasks=0
rpdb_ver=00000002 rpdb6_ver=00000002
To verify that the FortiGate firewall is selecting the correct exit interface and source IP when trying to reach the FortiCloud server, use the following commands:
- Capture the FortiCloud debug logs:
diagnose debug reset
diagnose debug application forticldd -1
diagnose debug enable
To stop the debugs:
diagnose debug disable
diagnose debug reset
-
Manually send a request to log in to FortiCloud:
execute fortiguard-log login <username> <password>
-
Capture packet data using a sniffer for the destination FortiCloud server:
diagnose sniffer packet any "host x.x.x.x" 4 0 l
Replace 'x.x.x.x' with the FortiCloud IP address retrieved in the previous step.
-
If FortiGate randomly selects an IP address instead of a public or private IP address for connectivity with FortiCloud, proceed to the next step.
config log fortiguard setting
set source-ip <ip address>
set interface-select-method specify
set interface <interface>
end
-
After configuring the correct source IP address and exiting the interface in the FortiGuard log settings, refer to Step 2 to send a request to log in to FortiCloud and verify the connection.
execute fortiguard-log login <username> <password>
Verification:
FortiGate1 (global) # diagnose test application forticldd 1
System=FGT Platform=FG32F1
Connection vdom: root, id=0, ha=primary.
acct_id=admin@test.ac.in
acct_st=OK
FortiGuard interface selection: method=specify specify=internet-rootFortiGuard log: status=disabled, full=overwrite, ssl_opt=1, source-ip=11.12.13.1
Centra Management: type=NONE, flags=000000bf.
active-tasks=0
rpdb_ver=00000002 rpdb6_ver=00000002
