Troubleshooting Tip: FortiGuard Support licenses show as expired
Description
This article describes how to troubleshoot the situation where the FortiGuard Support licenses show as expired in the FortiGate GUI, but they show as valid in the FortiCare account.
Scope
FortiGate.
Solution
The FortiGuard services and support contract details shown on the FortiGate unit should normally be synchronized with the contract details shown in the Asset Management section of the Fortinet Customer Service and Support web portal:
Support
Support
If the licenses on the FortiGate unit show as expired even though an active contract has been registered, it is possible to force the unit to update the contract details.
Go to System -> FortiGuard and in the upper right corner select the 'Update Licenses & Definitions Now' button. This will manually initiate an update.
Wait for five minutes, and the registration should be synchronized with the values shown on the Fortinet Customer Service and Support web portal.
If the licenses are still not correctly updated after the 5 minutes of waiting time, run the following commands in the command line to see what is happening:
diagnose debug disable
diagnose debug reset
diagnose debug application update -1
diagnose debug enable
execute update-now
When completed, clear the debugging with the following commands:
diagnose debug disable
diagnose debug reset
Example:
- Note that FortiGate in HA (2 or more units operating in a cluster) must have matching licenses.
- FortiGate in HA must be under the same FortiCare account.
- By default, when accessing the primary device's GUI, the expiration date of the contract that expires first will be displayed. If the secondary FortiGate is not registered, the cluster license will be considered invalid, and the GUI will display this invalid licensing information. Therefore, make sure that all the FortiGates in the HA cluster have a valid license applied.
Notes:
- In an air-gapped environment where the FortiGate device is not connected to the internet, the license file must be updated manually. The license should first be downloaded from FortiCloud using an internet-enabled device and then uploaded to the FortiGate device. This process ensures that the device remains properly licensed without requiring direct internet connectivity. See Licensing in air-gap environments.
- For FortiGate devices configured in HA sharing a single FortiGuard service license for both cluster units, the command set logical-sn enable must be configured under the HA settings in the CLI. For more information and supported models. See Single FortiGuard license for FortiGate A-P HA cluster.
Related articles: