Technical Tip: How to recover or re-provision a locked FortiToken Mobile in an HA cluster

In a FortiGate HA cluster, a FortiToken Mobile license is registered to a specific FortiGate serial number. FortiCare can transfer the entire license bundle to another device, but cannot reset individual tokens within that license.

Scenario:

• FortiToken Mobile license: EFTM010927018480.
• FortiToken:FTKMOBXXXXXEE4YY.
• FortiToken Registered to FortiGate: FG120GTK37018XXX while it was the primary.
• HA cluster members:
  • FG120GTK84214XXX (primary).
  • FG120GTK37018XXX (secondary).
• The token status is in a locked state and cannot be reassigned.

Important considerations:

• FortiToken Mobile licenses are tied to a specific FortiGate serial number.

• In HA, licensing and FortiCloud communication must occur on the unit that holds the license registration.

• Individual token reset is not possible from FortiCare - only full license transfer.

• Token renewal or deletion must follow official Fortinet procedures.

Resolution procedure:

Step 1 - Make the licensed unit the primary:

Since the license is registered to FG120GTK37018XXX , ensure this unit becomes HA primary.Adjust override priority or perform a controlled failover so that this ensures proper FortiCloud communication.

Step 2 – Restart the FortiCloud daemon:

Restart the FortiCloud process to refresh token status synchronization:

Use the command below:

diagnose sys process pidof forticldd

Take note of the PID that appears and restart the service with the command below:

fnsysctl killall forticldd

Verify if the process restarts correctly with the command below:

diagnose sys process pidof forticldd

If a different PID appears, the service restarted successfully.

This forces FortiCloud communication.

Step 3 – Re-provision (renew) the token:

Before renewal:

• Disable any user 2FA profile using the token FTKMOBXXXXXEE4YY.

After, run the following:

execute fortitoken-mobile renew FTKMOBXXXXXEE4YY

Verify the status with the command below:

config user fortitoken

    edit "FTKMOBXXXXXEE4YY"

        show

If the token changes from 'lock' to 'available', attempt to reassign it. If the issue persists, proceed to step 4.

Step 4 – Delete and re-add the token.

1. Delete the locked token.

Use the command below:

config user fortitoken

  delete FTKMOBXXXXXEE4YY

If multiple tokens are affected, delete all problematic tokens. Expected behavior after transfer/deletion is as described in the Fortinet Community article regarding mobile token behavior after transfer.

2. Re-add the mobile token.

1. Go to User & Authentication -> FortiTokens.

2. Select Create New.

3. Set the Type to Mobile Token.

4. Enter the Activation Code.

After FortiGuard validation:

• Tokens will appear in the list.

• The status will be Available.

Note: At the time of purchase, a PDF containing the Activation Code and total mobile token count is sent via email.

Validation:

After re-adding:

• Assign a token to the user.

• Activate on the mobile device (QR code or activation code).

• Confirm OTP validation succeeds.

• Re-enable 2FA on the user account.

Additional notes for HA deployments.

• Always perform token operations from the unit registered with the FortiToken license.

• Ensure proper FortiCloud connectivity.

• Confirm HA synchronization after changes.

• If the FortiGate hardware is replaced (non-RMA scenario), license transfer requires FortiCare assistance.

Related articles:

• Managing FortiTokens

• Technical Tip: How to Transfer a Mobile Token to a New Phone or Device

• FortiToken mobile license activation on a new HA FortiGate with a virtual serial number