Skip to main content
A
Anonymous_User
Contributor III
August 6, 2019

Technical Tip: FortiGate-VM license management, validation, and troubleshooting

  • August 6, 2019
  • 0 replies
  • 80009 views

Description

This article describes advice regarding FortiGate-VM (FGT-VM) License management, validation, and troubleshooting.

Scope

FortiGate.

Solution

By default, a FortiGate-VM includes a limited 15-day trial/evaluation license that supports:

  • 1 VDOM only.

  • 1 CPU and 1024 MB of memory maximum.

  • Low encryption only (no HTTPS administrative access).

  • All features except FortiGuard updates.


Note: As of FortiOS v7.2.1 and later, the FortiGate-VM Trial license model has been changed from a 15-day term to a permanent trial license (e.g., no time limit). However, this also requires administrators to register the FortiGate-VM Trial to FortiCare, and there is a limit of one FortiGate-VM trial per account. See the following link for more information: Permanent trial mode for FortiGate-VM. The following information in this KB article has been left as-is since it accurately describes legacy trial license behavior as well as general VM licensing behavior.

When instantiated that way, the Serial Number of the FortiGate-VM is always set to FGVM00UNLICENSED, its license status is set to 'Invalid', and the license expiration date is set 15 days ahead of the VM instantiation date.
This can be verified using the 'get system status' command. 

FGT-VM (global) # get system status


The FortiGate VM will show its version info:

Version: FortiGate-VM64-KVM v5.6.10,build1677,190716 (GA)
…
Serial-Number: FGVM00UNLICENSED
…
License Status: Invalid
Evaluation License Expires: Sat Sep 1 06:57:16 2019 
BIOS version : 04000002


A permanent license must be installed on the FortiGate-VM before the trial/evaluation license expires and the FortiGate-VM ceases functioning. Such a type of license must be obtained from the Customer & Service Support website and installed on the FortiGate-VM either at the GUI or at the CLI.

A license file contains information on the FortiGate-VM model that has been purchased, such as the minimum and maximum number of Virtual Domains, Virtual CPUs, Virtual Network Interfaces, Virtual Memory size, Virtual Storage size, etc.

This information is also reflected in the Serial Number that is going to be assigned to the FortiGate-VM, in replacement of the default Serial Number (FGVM00UNLICENSED), at the time the permanent license file is installed. Indeed, a FortiGate-VM Serial Number is composed of 3 different parts which follow the '<FGVM><XX><KEY>' pattern wherein:

  • FGVM: A string indicating the Serial Number pertains to a FortiGate-VM.

  • XX: A number (00, 01, 02, 04, 08, etc.) that defines the FortiGate-VM model. It has to be noted that '00' corresponds to the default FortiGate-VM model, the one that is associated with trial/evaluation licenses. A string (SL), which means subscription licensing (S-series).

  • KEY: A 10-digit number uniquely identifying a FortiGate-VM Serial Number or 'UNLICENSED' for trial/evaluation licenses.

 

Once installed, the permanent license needs to be validated by FortiGuard or by FortiManager in case the FortiGate-VM is installed in a closed environment without Internet access.

During that time, the license status is usually 'Pending'. Once validated, the FortiGate-VM license status changes to 'Valid'.

This can be verified using the 'get system status' command. See the example output below:

get system status
Version: FortiGate-VM64-KVM v5.6.10,build1677,190716 (GA)
…
Serial-Number: FGVM010000******
…
License Status: Valid
BIOS version : 0400000

 

Periodically, on an hourly basis, the FortiGate-VM needs to revalidate its license against FortiGuard or FortiManager. If the license re-validation is successful, the license status stays 'Valid'. If it does not, such as during the event of a network connection issue, the license status changes to 'Warning'. If the network connection is restored, the re-validation succeeds, and the license status comes back to 'Valid'; otherwise, the license status becomes 'Invalid' after the grace period of 30 days elapses and the FortiGate-VM ceases functioning.

In summary, the 'License Status' field can be in state 'Pending' or 'Valid' if the licensing process is proceeding as expected, and 'Warning' or 'Invalid' if something wrong is detected.

  • Pending: A temporary state wherein the VM is attempting to validate its license.

  • Valid: The VM can connect and validate the license against a FortiManager server or Fortinet Distribution Server (FDS).

  • Warning: The VM cannot connect and validate against a FortiGuard or FortiManager server. A check is made against how many days the warning status has been continuous. If the number is less than 30 days, the status does not change.

 

Invalid: The VM cannot connect and validate against a FortiGuard or FortiManager server. A check is made against how many days the warning status has been continuous. If the number is 30 days or more, the status changes to Invalid. The VM starts discarding all packets and effectively ceases operation.

If a license issue is suspected, the following commands can be used to gather more detailed information about the license creation date and type, validity, status, last refresh date and time, etc.

diagnose debug vm-print-license 
SerialNumber: FGVM04TMXXXX1833
CreateDate: Mon May 16 15:01:16 2022
Key: yes
Cert: yes
Key2: yes
Cert2: yes
Model: 04 (9)
CPU: 4
MEM: 2147483647
VDOM license:
permanent: 10
subscription: 0

diagnose hard sysinfo vm full
UUID:     43a25dd3c1026947bef4e1158935153f
valid:    1
status:   1
code:     200
warn:     0
copy:     0
received: 4305755316
warning:  0
recv:     201907311247
dup:     

 

Collecting update debug output helps to identify what may cause the licensing issue. For example, the following debug output shows that FortiGate-VM fails to connect to FortiGuard servers due to a DNS issue. 

 

Debug commands:

diagnose debug application update -1
diagnose debug application forticldd -1
diagnose debug application cloudinitd -1
diagnose debug enable

 

Stop debugging:

diagnose debug reset
diagnose debug disable


upd_fds_load_default_server[939]-Resolve and add fds usupdate.fortinet.net ip address failed.
upd_fds_load_default_server6[1046]-Resolve and add fds usupdate.fortinet.net ipv6 address failed.
upd_fds_create_list[1295]-No server found for update[00000001]
do_setup[333]-Failed setup


Note 1: A code value outside of the 2xx-3xx range is typically indicative of a licensing issue. In cases where FortiFlex manages licensing, the code value ranges are different (1,57,58, etc.), and the following document can be used to check codes and troubleshoot further: VM License.

Note 2: Beginning with FortiOS v7.4.10, when anycast is enabled, VM license activation for FortiGate-VM utilizes dedicated activation FQDNs instead of the general update FQDNs. This enhancement improves activation performance and reliability. There is no change to the default behavior when anycast is disabled; FortiGate continues to use the legacy general update FQDNs. For additional information, refer to Dedicated activation FQDNs for VM licensing.

Network validation & CLI-based license forcing.

Many license issues stem from connectivity problems between the VM and FortiGuard. Guidance should include:

  • DNS and Internet reachability checks (e.g., 'execute ping update.fortiguard.net').

  • Use the CLI command 'execute update-now' to force a license validation attempt immediately.

  • If using FortiManager, include proxy override configuration for license validation.

 

These steps empower admins to restore license state even in restricted environments reliably.

 

From v7.6.0, it is recommended to set up the VM with at least 4 GB of RAM for optimal performance. See FortiGate VM memory and upgrade.

 

Related documents:

      Terms & ConditionsAccessibility statement