Technical Tip: 'FortiGuard license is expired' log messages

Description

The article describes why FortiGate records some Event Logs, saying that the FortiGuard license has expired. It explains what happens if the FortiGuard contract expires, and what happens if the FortiGate license expires.

Scope

FortiGate v7.0 and above.

Solution

The log messages may appear due to one or more of the following reasons:

The Trial or Evaluation period has expired: When the status of FortiGuard-Web or FortiGuard-AntiSpam is checked on the GUI or activate one (or more) of these for the first time, a 30-day trial period for the respective feature begins. After the trial period, log messages such as the following will begin to appear, notifying the user that the Trial is over.

2016-03-07 09:17:07 device_id=FGTxxxxxxxxxxxxx log_id=0100020101 type=event subtype=system pri=critical msg="Fortiguard license is expired"

Contract is over: If a FortiGuard Contract is purchased, and the FortiGuard contract is not renewed, the log messages like the one below indicate that the FortiGuard license has expired:

2016-03-01 21:35:58 device_id=FGTxxxxxxxxxxxxx log_id=0100020101 type=event subtype=system pri=critical msg="Fortiguard license is expired"

What happens if the FortiGuard contract expires:

If the license is not renewed, the following features will stop working:

• FortiGuard web filter will lose connection, so FortiGuard category-based web filtering will stop working (policies, where the Web filter is applied, will block traffic), user may need to remove Web Filter profile to pass the traffic. However, if there is Static URL filtering applied, that will still work as per the configured entries.

• AV and IPS scanning will continue to work, but the signature databases will not be updated on the FortiGate. This is very important as the firewall will no longer offer protection against new threats including zero day threats.

• Any feature that requires connectivity with the FortiGuard network will no longer work, like DNS filtering

• Application Control will still continue to work, but it will be using the old signatures with no possibility to update the signature database.

• FortiGate-VM licenses will lose GUI access for management (limited only to uploading a new license file). CLI access is allowed.

• The firewall cannot upgrade to the next minor or major firmware version. However, FortiGate will enforce an automatic update to the latest patch of the current minor version. This also applies if the appliance has reached End of Support (EOS).

Additional note:

The GUI will show the status as 'License expired'.

Use the following commands for debugging:

diagnose debug reset
diagnose debug app update -1
diagnose debug enable

To stop it:

diagnose debug disable
diagnose debug reset

After renewal, a reboot may be necessary in some cases to restore full functionality.

To check updated license information, use the following command:

diagnose test update info
...
Support contract: pending_registration=255 got_contract_info=1
account_id=[xxx@example.net] company=[XXXX] industry=[Technology]

Alternatively, use the following command: 

diagnose test update info | grep FMWR
FMWR,Wed Nov 11 20XX
This will print the System contracts validity date for the firmware.

For a detailed description of the expiration impact for each license type, see License Expiration.

Note: In certain (older) FortiOS builds, these messages may be displayed even if the contract is valid. Those versions are no longer supported. Update to a supported FortiOS version first. See Product Life Cycle.