Technical Tip: FortiGate stucks in Validating License screen ('License is being validated by FortiGuard')

This article describes the case when FortiGate GUI is stuck with the error 'License is being validated by FortiGuard'. 

In a normal operation, after uploading the license or launching a VM for the first time, a prompt on the GUI appears about the license being validated by the FortiGuard server:

A successful license validation allows to log in to FortiGate’s GUI:

However, it is possible to encounter the issue where the first screen loads for a long time, in which it will show a button to select on the CLI console to check the network connection.

Make sure the following requirements are met for the connection to the FortiGuard:

• Internet must be reachable: try to ping public DNS servers like 8.8.8.8, 1.1.1.1, 8.8.4.4.
• Make sure that the firewall can resolve the domain name: try to ping:

execute ping service.fortiguard.net

And:

execute ping update.fortiguard.net

Note:

Hostname resolution is required for the FortiGate to maintain connectivity to FortiGuard services.

On CLI, verify the below command configuration is correct for DNS and FortiGuard Settings:

DNS:

config system dns
    set primary 96.45.45.45
    set secondary 96.45.46.46
    set protocol cleartext

end

FortiGuard:

config system fortiguard

    set fortiguard-anycast disable

    set protocol udp

    set port 8888

    set sdns-server-ip 208.91.112.220 173.243.140.53 210.7.96.53 200.91.112.220

end

If both requirements above are met, run the commands below to troubleshoot (Troubleshooting Tip: Unable to connect to FortiGuard servers:(

diagnose debug application update -1
diagnose debug enable
execute update-now

Leave it running for a couple of minutes.

To disable it, type this command: 

diagnose debug disable

Check the debug output for different scenarios: 

• FortiGuard is not reachable via the default Anycast method: following this article to adjust the FortiGuard setting as necessary: Technical Tip: FortiGuard is not reachable via Anycast default method.
• Cert error 9: A certificate is not yet valid.

2022-01-11 14:06:17 [360] __ssl_crl_verify_cb: Cert error 9, certificate is not yet valid. Depth 0
2022-01-11 14:06:17 __upd_peer_vfy[329]-Server certificate failed verification. Error: 9 (certificate is not yet valid), depth: 0, 
2022-01-11 14:06:17 [1013] ssl_connect: SSL_connect failes: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
2022-01-11 14:06:17 ssl_connect_fds[392]-Failed SSL connecting (5,0,Success)

Error: 9 (certificate is not yet valid)

Then it will be necessary to check the FortiGate system time. Refer to the below KB article to adjust the date/time settings on the FortiGate: Technical Tip: Setting the system time.

After adjusting the settings, the validation will go through.

• Failed connecting after sock writable:

upd_comm_connect_fds[455]-Trying FDS [2620:101:9000:140:173:243:140:6]:443

tcp_connect_fds[265]-Failed connecting after sock writable

upd_comm_connect_fds[469]-Failed TCP connect

upd_act_HA_contract_info[714]-Error updating FSCI -1

Try to explicitly specify the interface to connect to the FortiGuard server by executing the following commands:

config system fortiguard

    set interface-select-method specify (the default option is auto)

    set interface <WAN-interface>

end

Check the update debug again to see if the FortiGuard servers are reachable now. If not, open a case with TAC for further assistance: Support.

• DNS not reachable:

upd_fds_load_default_server6[1046]-Resolve and add fds usupdate.fortinet.net ipv6      address failed.

upd_fds_create_list[1295]-No server found for update[00000001]

do_setup[348]-Failed setup

• If the VM is in an HA cluster, then each member should have a valid license. If the secondary member does not have a valid license, the primary FortiGate may get stuck on the license validation screen. To resolve this issue, either shut down the secondary VM or purchase a valid license for the secondary unit.
• Additionally, ensure that all FortiGate VM cluster members are registered under a single account: Technical Tip: The HA Cluster requirements.

Try to check DNS connectivity with FortiGate. Refer to the following KB article to bring DNS connectivity back on the FortiGate: Technical Tip: DNS stops working when using custom DNS.

It is worth checking if any proxy is configured for FortiGuard connectivity. The same way a source-ip is specified for different FortiOS services (DNS, FortiGuard, Syslog, etc.), a proxy can be configured to tunnel traffic from FortiGate to FortiGuard through a proxy appliance: Technical Tip: How to identify if the FortiGate is using proxy server to receive update from FortiGuard by analysing the debugs.

This feature was introduced in FortiWeb appliances and is also available on all FortiOS versions.

config system autoupdate tunneling
    set status enable
    set address '10.10.10.1'
    set port 8080
    set username 'test'
    set password test

end

Disable this feature and test if FortiGuard is reachable to get license information:

config system autoupdate tunneling
    set status enable

end

Note: 

In v7.6.3 and above, the 'config system autoupdate tunneling' command has been removed and replaced with 'config system fortiguard'. See Changes in CLI.

config system fortiguard

    set proxy-server-ip <proxy_address>

    set proxy-server-port <proxy_port>

    set proxy-username <username>

    set proxy-password <password>

end

In some scenarios, the acquired license may be low-encryption (LENC). Low encryption uses TLS version 1.0, which prevents FortiGuard validation because it is no longer supported, and there is no option to use a stronger cipher when this license is in use. To validate a lower license, run the following command:

get system status | grep License
<...>

License Status: Low-Encryption(LENC)

Use a regular license, as low encryption licenses cannot be validated.

Another option to validate the license:

To obtain the IP of the FortiGuard server contacted, the following debugs are required from the CLI:

diagnose debug reset

diagnose debug application updated -1
diagnose debug console timestamp en

diagnose debug enable

execute update-now

A packet capture where x.x.x.x is the IP being used to initiate the connection to FortiGuard.

diagnose sniffer packet any 'host x.x.x.x and port 443' 6 0 l

After attempting to re-validate the license,  check the headers of the "Client Hello" packet sent from the firewall in the packet capture.

If all of the above have been checked and the issue persists, try to run the following command:

execute vm-license <token>

Note:

This command will require a reboot of the FortiGate, so make sure to run it out of business hours or during a maintenance window.

This command will manually download the VM license and can help in cases when the issue is caused by the built-in certificates of the FortiGate VM.