Technical Tip: Unable to import mobile FortiTokens receiving error: 'import fortitoken license error: -7549'

When importing the FortiToken mobile, use the following command:

execute fortitoken-mobile import "xxxx-xxxx-xxxx-xxxx-xxxx"

Replace xxxx-xxxx-xxxx-xxxx-xxxx with the activation code.

If the error 'import fortitoken license error: -7549' occurs, proceed to the next steps.

Run the commands below to collect diagnostic information:

diagnose debug app forticldd -1

diagnose debug app alert -1
diagnose fortitoken debug enable
diagnose debug enable

To stop debug logs:

diagnose debug disable 

diagnose debug reset

Expected output when the problem occurs is similar to:

ftm_fc_comm_connect[55]:ftm TCPS connected.ftm_fc_comm_send_request[117]:send packet success.

POST /SoftToken/Provisioning.asmx/Process HTTP/1.1
Accept: application/json, text/javascript, */*, q=0.01
Content-Type: application/json;charset=utf-8
X-Requested-With: XMLHttpRequest
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: 173.243.138.85:443
Content-Length: 246
Connection: Keep-Alive
Cache-Control: no-cache

{ "d": { "__type": "SoftToken.ActivationLicenseRequest", "__version": "4",

"license_activation_code": "xxxx-xxxx-xxxx-xxxx-xxxx", "serial_number": "FGTx",

"__device_version": "7.0", "__device_build": "0682", "__clustered_sns": [ ] } }

ftm_fc_comm_recv_response[266]: receive packet success.

{"d":{"__type":"SoftToken.ActivationLicenseResponse","__version":"4","serial_number":"FGTx",

"__device_version":"7.0","__device_build":"0682","__clustered_sns":[],"license_activation_code":"xxxx-xxxx-xxxx-xxxx-xxxx"","license":"","tokens":null,"result":0,"error":{"error_code":-1,"error_message":"forticare unkown error"}}}

ftm_fc_command[615]:received error from forticare [-7549]
import fortitoken license error: -7549

To disable the debug run command:

diagnose debug disable

The error typically indicates a communication issue between the FortiGate device and FortiGuard servers during license activation.

Run the following command to optimize the traffic and communication with the FortiGuard servers; this also disables Anycast as the method of communication with FortiGuard.

config system fortiguard
    set fortiguard-anycast disable
    set protocol https 
    set port 8888
    set sdns-server-ip 208.91.112.220 173.243.140.53 210.7.96.53
end

execute update-now

Run the import command again:

execute fortitoken-mobile import "xxxx-xxxx-xxxx-xxxx-xxxx"

After successful activation, the FortiToken should appear under the menu User & Authentication -> FortiToken.

Related articles:

Technical Tip: FortiGuard is not reachable via Anycast default method

Troubleshooting Tip: Unable to connect to FortiGuard servers