Technical Tip: Failed to upgrade due to 'expired firmware updates license' while upgrading FortiGate 30G/31G from v7.4.8 to v7.4.9, v7.4.10 or v7.4.11

While upgrading the FortiGate 30G/31G units via FortiGuard or the manual method, the upgrade fails with the error 'Image upgrade failed. Failed to upgrade due to expired firmware updates license', even though the license is valid.

The following output is observed on the serial console port when attempting the firmware upgrade:

Verifying the signature of the firmware image.
Image verification OK!
inflate failed: round 1, err -3
Check image error.
Command fail. Return code -28

This issue occurs when a firmware upgrade is applied while the device is running at 63% memory utilization or higher, as in the example below:

get system status

Version: FortiGate-30G v7.4.8,build5164,250612 (GA.M)

get system performance status

CPU states: 5% user 1% system 0% nice 94% idle 0% iowait 0% irq 0% softirq
CPU0 states: 11% user 3% system 0% nice 86% idle 0% iowait 0% irq 0% softirq
CPU1 states: 1% user 0% system 0% nice 99% idle 0% iowait 0% irq 0% softirq
CPU2 states: 6% user 1% system 0% nice 93% idle 0% iowait 0% irq 0% softirq
CPU3 states: 3% user 1% system 0% nice 96% idle 0% iowait 0% irq 0% softirq
Memory: 1964064k total, 1303804k used (66.4%), 421540k free (21.5%), 238720k freeable (12.1%)

To lower the memory utilization, use the following workaround.

1. Change the IPS global settings as shown below:

config ips global

    set engine-count 1

    set cp-accel-mode none

end

2. Temporarily remove the security profile from the policies to reduce memory utilization and to upgrade the device.
3. Reboot the device. The system memory should drop 50 percent below, after which the upgrade via the GUI should succeed.
4. After the device has been successfully upgraded, these settings can be reverted, and the security profiles can be re-enabled in the policies.

config ips global

    unset engine-count 

    unset cp-accel-mode 

end

This issue has been reported internally and is currently being investigated by Fortinet engineering.

It is scheduled to be fixed on FortiOS v7.6.7 (ETA is the last week of May 2026) and v8.0.0 (ETA is in April 2026).

Related article:
Troubleshooting Tip: Error messages 'This Firmware image didn't pass the signature verification.' and 'Firmware upload failed' when attempting to upgrade firmware image