Technical Tip: Resolving CMDB save errors for hardware FortiToken on FortiGate

FortiGate displays the error message 'Error', 'cmdb save error', or 'Alreadyactivated' when importing or activating a physical FortiToken seed.

In this case, verify whether the issue matches the relevant log entries shown below.

diagnose fortitoken info
FORTITOKEN DRIFT STATUS
FTK200BB******  0 cmdb save error

Troubleshooting commands to identify the issue:

diagnose fortitoken info diagnose debug disable diagnose debug reset diagnose debug application forticldd 255 diagnose fortitoken debug enable diagnose debug enable

This error does not indicate a defect with the newly purchased FortiToken hardware.
It is a known issue (bug ID:1218458) affecting FortiOS v7.4.10, v7.4.11, v7.6.3 to v7.6.6.

This issue is scheduled to be resolved in:

• v7.4.12 (scheduled to be released in April 2026).
• v7.6.7 (scheduled to be released in April 2026).
• v8.0.0 (scheduled to be released in April 2026).

These timelines for firmware release are estimated and may be subject to change.

Workaround:

Use the seed file import instead of the serial number entry. The token seed file can be obtained by contacting Fortinet Customer Service. Refer to Technical Tip: Process for requesting token seed files for hardware FortiTokens.

Request FortiGate/FortiAuthenticator FTK200CD Seed with Customer Service. Follow the steps below:

1. Extract the Zip file with the password provided by Customer Service.

2. Log in to FortiGate and navigate to User & Authentication -> FortiTokens -> Local tokens.

3. Select Create New -> Import -> Seed File -> Upload -> Select 'output_FTK200CD.txt' -> Select OK.

4. Navigate to User & Authentication -> FortiTokens -> Local tokens. All newly imported FortiTokens will be visible.

Related document:
Registering hard tokens