Technical Tip: Missing contracts when update from FortiManager

In some of the user's closed environments or with no internet access to get an update from FortiGuard, it is required to get an update from FortiManager.

The connection between FortiGate and FortiManager can be troubleshoot using update debug, and missing contracts can be observed  as shown in the example below:

upd_status_set_ha_expiry[1511]-Serial Number: FGXXX- contract processed
upd_status_set_ha_expiry[1526]-Missing contracts, got 1, expect 2 <-----
upd_status_set_ha_expiry[1544]-Reset expiry
__update_upd_comp_by_settings[494]-Disabling NIDSDB/ISDB/MUDB components.
__update_upd_comp_by_settings[498]-Disabling APPDB/IOTDB components.

do_update[678]-UPDATE failed

The update debug to be used on FortiGate:

diagnose debug reset
diagnose debug application update -1

diagnose debug console timestamp enable

diagnose debug enable

execute update-now

To disable the debug:

   diagnose debug disable

The issue is caused by FortiManager only updating 1 contract out of 2; it is required to request account entitlement or contract and upload to FortiManager:

Requesting account entitlement files
Uploading account entitlement files

A Fortinet Customer Service ticket can be created for contract and license issues, such as when HA cluster members are not registered to one account and a FortiManager ticket is required if the upload failed.