Technical Tip: FortiToken Mobile cannot be provisioned after upgrading FortiGate to v7.4.9 and v7.6.5

A FortiToken license must be registered to a FortiGate serial number. In a cluster with two or more FortiGate units, FortiTokens can be shared across the cluster, even if the unit to which the tokens are registered is operating as the secondary unit.

However, after upgrading the FortiGate firmware to version 7.4.9 or 7.6.5, administrators are unable to assign or provision FortiToken Mobile tokens to users if the FortiToken license is not registered to the primary (active) unit in the cluster.

For example, if FortiTokens are registered to the serial number of FortiGate-A, but FortiGate-B is the active unit in the cluster, FortiToken provisioning will fail after upgrading to version 7.4.9 or 7.6.5.

To determine whether a FortiGate cluster is impacted by this known issue, run the following debug commands and attempt to assign an available FortiToken to a user (via GUI or CLI):

diagnose fortitoken debug enable
diagnose debug cli 8
diagnose debug enable

The following logs can be seen in the debug output:

On FortiOS v7.4.9:

{"d":{"__type":"SoftToken.ProvisionResponse","__version":"4","serial_number":"FG10E1TB20900556",

"__device_version":"7.0","__device_build":"2829","__clustered_sns":[{"sn":"FG10E1TB20******","error":null}],"tokens":[{"token":"FTKMOB2A0******","license":null,"token_activation_code":null,"qr_code":null,

"code_expire":null,"error":{"error_code":31,"error_message":"token does not belong to product"}}],"result":0,"error":{"error_code":17,"error_message":"no valid token found"}}}
2025-11-06 15:39:49 ftm_fc_command[611]:received error from forticare [-7567]

On FortiOS v7.6.5 or v7.6.6:

ftm_cfg_provision_token[426]:provision token: FTKMOB******
ftm_fc_provision_token[812]:Provision token:FTKMOB******
ftm_fc_comm_connect[66]:ftm TCPS connected.
ftm_fc_command[595]:{ "d": { "__type": "SoftToken.ProvisionRequest", "__version": "4", "__device_version": "7.0", "__device_build": "3652", "serial_number": "FG200FT******", "__clustered_sns": [ { "sn": "FG200FT******" } ], "tokens": [ { "token": "FTKMOB******", "seed": "XXXXXXXXXXXXXXXXXXXXXXXXX", "code_expire": 4320, "type": "totp", "period": 60, "digits": 6 } ] } }
ftm_fc_comm_send_request[129]:send packet success.
ftm_fc_comm_recv_response[280]:receive packet success.
ftm_fc_command[613]:received error from forticare [-7567]

If only a single FortiGate serial number appears in the '__clustered_sns field', the cluster is affected by this issue.

On FortiOS v7.4.8 or below:

{ "d": { "__type": "SoftToken.ProvisionRequest", "__version": "4", "__device_version": "7.0", "__device_build": "2795", "serial_number": "FG10E1TB23******", "__clustered_sns": [ { "sn": "FG10E1TB23******" }, { "sn": "FG10E1TB20******" } ], "tokens": [ { "token": "FTKMOB09B******", "seed": "******", "code_expire": 4320, "type": "totp", "period": 60, "digits": 6 } ] } }
ftm_fc_comm_recv_response[278]:receive packet success.

The serial numbers of both FortiGate units in the HA cluster are displayed in the '__clustered_sns' field in the working scenario.

This issue has been resolved in:
v7.4.10 which has been released in January 2026.

v7.6.7 (scheduled to be released in May 2026).
v8.0.0 (scheduled to be released in March 2026).
These timelines for firmware release are estimated and may be subject to change.

Workaround:
Perform a failover so that the unit with the FortiTokens registered becomes the active unit, or downgrade to a firmware version earlier than v7.4.9.

Note:

This issue is specifically observed on FortiGate models that currently do not support the Virtual Serial Number (vSN) feature (Single FortiGuard license for FortiGate A-P HA cluster).
Only a FortiToken provisioning to users (linking a FortiToken to a user in the configuration) is affected.
Users who already have FortiTokens assigned can continue to use them without issue.
Registering new FortiToken licenses is not impacted.