Skip to main content
ppatel
Staff & Editor
ppatel
Staff & Editor
July 11, 2019

Technical Tip: Restoring an accidentally deleted trial or licensed FortiToken Mobile ('FTM')

  • July 11, 2019
  • 0 replies
  • 44138 views

Description

 

This article describes how to re-add a trial or licensed FortiToken Mobile ('FTM') after accidentally deleting it without restoring a backup configuration, or how to restore a license stuck in a state where it is not possible to provision the trial FortiToken to a user. This also covers RMA devices that have been replaced, where the configuration has been restored. It will be necessary to delete the two tokens as well. In the second half of this article, there is an explanation of how to re-add a deleted, accidentally licensed FortiToken Mobile. Otherwise, error messages like 'input value is invalid' or 'no valid token found' may be seen.

 

Scope

 

Any FortiGate device with a license key file (usually a PDF file) with a 20-character activation code tied to the device.

 

Solution

 

Part 1:Trial tokens:

 

The solution is to delete the other trial tokens and download them again from the FortiGuard network.

This step-by-step guide uses the two FortiTokens included in the FortiGate, running under the license 'FTMTRIALXXXXXXXX', with one of the two FortiTokens already deleted.

 

  1. One token is missing:

kb_15538_1.png


  1. To import the missing FortiToken again, the remaining FortiToken has to be deleted as well. To find out which token belongs to the trial license, check the backup configuration in the 'config user fortitoken' section. A line referring to the trial license should be displayed.


For example:

 

config user fortitoken
    edit "FTKMOBXXXXXXXXX"
        set license "FTMTRIALXXXXXXXXXX"
    next
end


If the FortiToken to be deleted is already associated with a user, remove their association first.

FortiTokens lists associated users under the 'User' column in the FortiToken list.

  1. FortiTokens can be associated with user accounts (User & Authentication -> User Definition) or with administrator accounts (System -> Administrators).

  2. Delete the FortiToken by selecting it and deleting it.

  3. Once both free trial FortiTokens are removed, it is possible to either download them again from the FortiGuard network using the download button or by using a specific license number.

    1. The Import Free Trial FortiToken button will appear:

       

      UntitleDDDd2.gif

       

    2. Select the Create New button at the top and select Mobile Token.
      An input field for an 'Activation Code' will be presented. For the aforementioned trial FortiTokens, the Activation Code is 0000-0000-0000-0000-0000:

 

kb_15538_3.png

 

It is necessary to include all hyphens '-'. After entering the code, select OK.


The FortiTokens should be displayed in the list again:

 

kb_15538_4.png

 

To import a free trial FortiToken in the CLI, run the following command: 

 

execute fortitoken-mobile import 0000-0000-0000-0000-0000

 

Note:

This simple guide fixes small problems, but cannot replace a regular configuration backup. The FortiToken Mobile could also be restored when the FortiToken was still available, but restoring a configuration requires a restart. Both trial tokens must be removed from the device before recovery can be performed.
If VDOMs are enabled, trial Tokens are in the management VDOM (the root by default).

 

Part 2: Licensed tokens:

 

  1. In the following image, seven tokens are listed (2 trials and 5 licensed). Two trial tokens are either already provisioned or pending assignment to user accounts.

 

Licenses_Bef_Purging.png

 

  1. If any licensed tokens have been accidentally purged, restoration and re-addition to the device can be performed by following the steps below.

  2. In the FortiGate GUI, navigate to User & Authentication -> FortiTokens and select Create New. In the example below, three mobile tokens were purged.

     

    Re-adding_Create_Button.png

     

  3. Select 'Mobile Token' as the Type, then copy and paste the Activation Code from the PDF file:

     

New_Token_Adding.png


Upon successful import, all accidentally purged FortiTokens are restored and added to the list. Important note: any tokens that have already been assigned will not be affected.

 

Licenses_Bef_Purging.png

 

Note:
If the FortiToken licensing PDF file is unavailable, a ticket must be submitted to the FortiCare Support: Customer Service team to request a copy.

If the licensed FortiTokens are mapped to a secondary HA device, the activation code might fail. To resolve this, perform an HA failover and attempt to import the FortiToken Mobile using the activation codes.

 

The following error codes may appear in the CLI.

  • If the unit is not registered:

 

execute fortitoken-mobile import 0000-0000-0000-0000-0000
import fortitoken license error: -7571

 

  • If the serial code format is incorrect:

 

execute fortitoken-mobile import 0000-0000-0000-0000-00 
import fortitoken license error: -7566

 

Related articles:

      Terms & ConditionsAccessibility statement