There could be an instance where FortiGate Cloud is already activated but shows as inactive in the FortiGate Cloud portal.   Refer to the following for such a case: If the device is in an HA cluster, then it is expected that the secondary device will show as inactive. This is because the management tunnel can only be up for the primary device. If the device is not in an HA cluster or acting as the secondary device, the status should show as active. Check the Region where FortiGate Cloud is activated and verify that the portal is logged in to the same Region. Access the inactive FortiGate and verify connectivity to FortiGuard servers. Refer to this link to troubleshoot any issues with FortiGuard server reachability: Troubleshooting Tip: Unable to connect to FortiGuard servers. If FortiGuard servers are reachable, check the central-management settings if enabled:
 config system central-management
  set type fortiguard
end
 Verify if there is an upstream device that could be blocking/inspecting traffic between the FortiGate and FortiGate Cloud. TCP/541 is used for management access. Refer to Technical Tip: IP address and port used for FortiCloud for the list of IP ranges and ports used by FortiGate Cloud.
To confirm if TCP 541 connection or other FortiCloud port between the FortiGate and FortiCloud is working, run packet capture in FortiGate while executing the following command: Â fnsysctl killall fgfmd
 To capture the relevant packets, run the CLI commands below or use the Packet Capture feature on the GUI.
CLI:
 diagnose sniffer packet any 'port 541' 4 0 l
Or:
 diagnose sniffer packet any 'port 541' 6 0 l
 While collecting the above sniffer, check the connectivity with telnet to port 541.
diagnose test application forticldd 3 <--- Look for "Home log server" IP
execute telnet <Home log server IP from above command> 541
 Collect debug log using the following commands:  diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application forticldd -1
diagnose debug enable
diagnose debug disable --->Â Run this to stop the debug.
diagnose debug reset
 Another troubleshooting step that can be performed is to undeploy the FortiGate on FortiGate Cloud. From the FortiGate, log out of the FortiCloud account under Central Management and then log in again with the correct region. Refer to: Undeploying and redeploying a FortiGate.
 FortiGate Cloud management connectivity should then show as active:    To remove the inactive devices, go to Device and Provisioning -> Provisioning -> Choose the Firewalls and select Deprovision.
Related articles:
Technical Tip: FortiGate Cloud shows management tunnel down Technical Tip: How to register/activate FortiGate Cloud from GUI and enable logging | 
