Technical Tip: FortiGate behavior when FortiGuard licenses are expired

• Firewall: Firewall services will be fully functional.
• High Availability (HA): HA will be fully functional.
• Antivirus (AV): The Antivirus engine will be fully functional. However, new signatures will not be updated in the FortiGate.
• Anti-malware:  Anti-malware engine will be fully functional. However, new signatures will not be updated in the FortiGate.
• Intrusion Prevention (IPS): The IPS engine will be fully functional. However, new signatures will not be updated in the FortiGate.
• Application Control: The application control engine will be fully functional. However, new application definitions will not be updated in the FortiGate.
• Virtual Private Networking (VPN): The VPN engine will be fully functional.
• Web Filtering: Web Filter engine will work. However, Category-based Web and DNS filtering stop working, as URLs and domains are sent to FortiGuard in real-time to determine the category. By default, all web traffic is dropped. If allowing website requests when a rating error occurs is enabled, then all web traffic passes through without filtering. Static URL filters are applied in a filter profile, and those filters continue to work.
• Email Filtering: The Antispam engine will be fully functional. However, FortiGuard spam filtering features that function with the cloud will stop until licenses are renewed.
• DNS filtering: The DNS filtering engine will be fully functional. However, online queries if configured (dynamic classifications/domain categorization) will not be possible. For example, a DNS filter with custom/static domain filtering will be operational, but dynamic filters based on cloud classifications from FortiGuard will stop until licenses are renewed.
• Data Loss Prevention (DLP): DLP services will be fully functional.
• SD-WAN: SD-WAN services will be fully functional.
• Advanced Routing: The routing engine will be fully functional.
• Explicit Proxy and WAN Optimization: Explicit Proxy and WAN Optimization functions will be fully functional.
• QoS & Traffic Shaping: QoS & Traffic Shaping Optimization functions will be fully functional.
• Outbreak Prevention: Outbreak Prevention will stop working as this requires real-time lookups to the FortiGuard database.
• Operational Technology (OT): OT Security Services will be fully functional. However, no new signatures will be added.
• Inline-CASB Application Definitions: Inline-CASB will continue to work, but the databases are not updated and no new signatures are added.
  

See the FortiGate Administration Guide for more information.

Related documents:
Technical Tip: List of features that will still continue to work if FortiGate subscription is expired  

License expiration