Troubleshooting Tip: How to fix a Licensed Mobile Token with an Error/Locked/Provision Timed Out status
Description
This article describes how to fix a licensed FortiToken with a locked status of 'Error', 'Locked', or 'Provision Timed Out'.
Scope
FortiToken Mobile.
Solution
For Purchased Mobile Tokens:
Step by step:
- Delete all the Tokens that have issues.
- To delete the token, make sure to unassign/revoke it from the User it is assigned to.
- Afterwards, select the tokens and delete them.
- To add those FortiTokens, go to User & Authentication/FortiTokens -> Select Create New -> Set the Type to Mobile Token and enter the Activation Code.
- After FortiGuard validates the code, the FortiTokens will appear on the list, with the Status set to Available.
Note:
- For all purchased/licensed tokens at the time of purchase, a PDF of a FortiToken Mobile Redemption Certificate containing the 'Activation Code,' along with the total number of mobile tokens, will be sent via email.
- If the FortiToken Mobile Redemption Certificate is not received, submit a ticket to the Customer Service Team to request: Technical Tip: How to create a ticket for Fortinet TAC
- If an expired license is deleted, it cannot be recovered, not even with customer service assistance.
- Tokens must be activated within a year from purchase; failure to activate will forfeit the FortiToken entitlement.
Via the CLI:
Sometimes, renewing the token via CLI fixes the issue (Only for Error/Locked status):
execute fortitoken-mobile renew <Serial Number of particular Token>
For example:
execute fortitoken-mobile renew FTKMOBxxxxxxx
Now, check the status of a particular token. If the status doesn't change, follow all of the above-mentioned steps, aside from the one directly above this.
To add Tokens:
execute fortitoken-mobile import "xxxx-xxxx-xxxx-xxxx-xxxx"
Where 'xxxx' will be the activation code.
Note:
The above commands are VDOM-specific. If VDOMs are configured, execute these commands in a specific VDOM.
Note:
The above commands are VDOM-specific. If VDOMs are configured, execute these commands in a specific VDOM.
If the FortiGate is in an HA cluster and getting error -7567 after running the command 'execute fortitoken-mobile renew FTKMOBxxxxxxx', make sure the FortiTokens license is tied to the Primary serial number.
Verify in the support portal which FortiGate unit the token license is assigned to, and perform a failover to make that FortiGate as the primary device.
Related articles:
Technical Tip: How to activate FortiToken Mobile trial
Technical Tip: FortiToken basic troubleshooting
Troubleshooting Tip: Get FortiToken Mobile activation code when activation email is not received
Technical Tip: Error: 'No valid token found' - Unable to Provision FortiTokens in HA environment
