Technical Tip: Unable to import mobile FortiTokens ('import fortitoken license error: -7500')

This article explains how to diagnose and fix an issue where the user receives a FortiToken license error with code -7500 while importing a FortiToken through the CLI.

When experiencing this issue, the user experiences the following:

• The error 'import fortitoken license error: -7500' appears.
• No tokens (trial or licensed) appear in response to the command 'show user FortiToken'.
• When trying to import a FortiToken mobile in the GUI, an internal server error occurs.
• The FortiGate can ping the FortiGuard servers.

Below is an example of what a debugging process returns:

diagnose debug application forticldd -1
diagnose debug application alert -1
diagnose fortitoken debug enable
diagnose debug enable

execute fortitoken-mobile import FTKMOB0A08Bxxxx
2022-10-03 20:48:43 ftm_cfg_import_license[321]:import license FTKMOB0A08Bxxxx
2022-10-03 20:48:43 ftm_fc_comm_connect[38]:ftm cannot resolve DNS
2022-10-03 20:48:43 ftm_fc_command[588]:forticare [ftm2.fortinet.net:443] unreachable
import fortitoken license error: -7500

Replace FTKMOB0A08Bxxxx with the activation code for the FortiToken

To stop the debug logging:

diagnose debug disable

diagnose debug reset

To fix the communication issue with license activation between the FortiGate and FortiGuard servers, follow the steps mentioned in Troubleshooting Tip: Unable to connect to FortiGuard servers 

Disable 'fortiguard-anycast' under 'config system fortiguard'  and import the FortiToken again on the GUI:

config system fortiguard
    set fortiguard-anycast disable
    set protocol https 
    set port 8888
    set sdns-server-ip 208.91.112.220 173.243.140.53 210.7.96.53
end

Alternatively, if the fortiguard-anycast-source is set to AWS. It is necessary  to change it to Fortinet as follows: