Technical Tip: Updating FortiGuard service license and support contract for a FortiGate in HA cluster

This article describes how to update the support contract and FortiGuard service license for a FortiGate in an HA cluster.

Updating a FortiGate cluster with a new support contract requires the same process as updating a contract for any other standalone FortiGate. The only difference is that it is necessary to purchase a contract for each cluster unit.

All members of an HA cluster need valid support contracts and valid licenses for FortiGuard services. It is not sufficient to only have coverage for the Primary unit alone. Note that some FortiGate models can be purchased with SKUs that allow a single FortiGuard license for an HA active-passive cluster. For more information, see Technical Tip: Additional Info regarding Single FortiGuard license for FortiGate A-P HA cluster feature.

On FortiGate VM firewalls, mismatched license resources, such as a differing CPU or differing memory limits between units in the HA cluster, may trigger resource limit errors. See this article: Troubleshooting Tip: 'License is invalid for current VM configuration. Upload a new license or reconfigure the VM' for more information on how to check for such issues.

If a new contract is only purchased for the primary device, the GUI will reflect the contract of any other subordinate unit that will expire first. For testing, the device without a contract can be removed from the network temporarily by shutting it down or physically isolating it from the network and the primary device. After the secondary device is no longer seen in the cluster, the primary device's GUI will reflect its own license information.

Note:

Make sure that the starting dates are valid in the contract. Sometimes, both devices show entitlement linked, although the dates might represent service starting next month or a year. 

Since February 2025, both units must be registered under the same FortiCloud account. If they are not, the cluster will show as unlicensed. See the article: Troubleshooting Tip: License not updating when FortiGate on HA have Different Account Registration.

Starting from v7.6.1 and v7.4.6, FortiGate A-P HA cluster supports sharing a single FortiGuard service license for both cluster units for the following models:

• 40F and variants.

• 60F and variants.

• 70F and variants.

• 80F and variants.

• 100F and variants.

For more information, check the following documents: Single FortiGuard license for FortiGate A-P HA cluster.

Related articles:

Technical Tip: Fortinet product registration and bulk registration.
Technical Tip: The license still shows as expired after renewal 
Troubleshooting Tip: Licenses do not show valid dates in HA