Technical Tip: Configure FortiManager as local FDN server for FortiFirewall to get license validated (VM license, Device level license FMWR, AV, IPS etc.)

Description

This article discusses whether the FortiFirewall can download the VM and device license information from FortiManager acting as the FortiGuard server, and how to identify the request and response on FortiManager to check the communication.

Scope

FortiManager v7.6.5.

Solution

Starting from v7.6.5, FortiManager supports license validation for FortiFirewalls.

Based on the FortiManager version, the corresponding version must be selected in the docs portal to check the supported information. The command below also helps in verifying the supported version and the models of the Fortinet devices in FortiManager:

diagnose dvm supported-platforms list detail

Configuration Management and logging were supported on FortiManager for FortiFirewalls; however, starting from v7.6.5, FortiManager also supports VM and device license validation for FortiFirewalls with serial numbers starting with FFVMBB.

Related document:
Feature support

From the FortiManager side, the only configuration necessary is to ensure FortiManager can reach the FortiGuard server.

Example output below:

diagnose fmupdate view-serverlist fds

Fortiguard Server Comm : Enabled
Server Override Mode   : Loose
FDS   server list      :
Index   Address                    Port            TimeZone        Distance        Source
------------------------------------------------------------------------------------------------------
*0      208.184.237.68             443             9               4               FDNI
 1      208.184.237.67             443             0               5               FDNI
 2      12.34.97.16                443             -5              10              FDNI
 3      208.184.237.66             443             -8              11              FDNI
 4      usfds1.fortinet.com        443             5               0               DEFAULT
 
FCT   server list      :
Index   Address                    Port            TimeZone        Distance        Source
------------------------------------------------------------------------------------------------------
*0      208.184.237.75             443             -8              11              FDNI
 1      usforticlient.fortinet.net 443             5               0               DEFAULT

Enable service access under System Settings -> Network and edit port1.

Once the FortiFirewall is configured with FortiManager as the FDS server, the FortiFirewall will send the VMSetup command request to FortiManager to validate the VM license and then the Update command to download the device-level license details.

VMSetup command request from FortiFirewall to FortiManager example below:

For example: 'Command=VMSetup' in the output:

diagnose fmupdate view-linkd-log fds

2026/07/14_16:55:10.929 info    fds_svrd[4897]: [FGT-->FMG] Request: Protocol=3.0|Command=VMSetup|Firmware=FFWKVM-FW-7.06-3651|SerialNumber=FFVMBBTM00000000|Connection=Internet|Address=10.x.x.x|Language=en-US|TimeZone=-7|UpdateMethod=0|Uid=f480b2629bd911efbf036fb865f00000|VMPlatform=KVM^M ^M ^M

2026/07/14_16:55:10.929 info    fds_svrd[4897]: FCP_CONN:: received package ready
2026/07/14_16:55:10.929 info    fds_svrd[4897]: __devobj_check_vmlic,870 : public_network, fds_conn=OK, serial=FFVMBBTM000000000, uid=f480b2629bd911efbf036fb865f000000, , vmlic_status=200, last_check=1784071823(2026-07-14 16:30:23), now-lask_check=1487(24 minutes 47 seconds), resp=200, forward=0, r=0
2026/07/14_16:55:10.929 info    fds_svrd[4897]: [FMG-->FGT] Response: Protocol=3.0|Firmware=FMG-VM64-KVM-FW-8.00-0155|SerialNumber=FMG-VMTM00000000|Response=200|Persistent=false^M ^M
2026/07/14_16:55:10.929 info    fds_svrd[4897]: Process client 10.x.x.x request SUCCESS
2026/07/14_16:55:10.930 notice  fds_worker[4913]: process remote(::ffff:10.x.x.x) SUCCESS!

The VMSetup request is sent almost every 1 Hour to FortiManager for license validation, or it will trigger the VMSetup request when the FortiFirewall is rebooted.

Update command request from FortiFirewall to FortiManager example below:

For example: 'Command=Update' in the output:

diagnose fmupdate view-linkd-log fds

2026/07/14_16:55:10.997 info    fds_svrd[4897]: [FGT-->FMG] Request: Protocol=3.2|Command=Update|Firmware=FFWKVM-FW-7.06-3651|SerialNumber=FFVMBBTM00000000|UpdateMethod=0|AcceptDelta=0|Uid=f480b2629bd911efbf036fb86500000|DataItem=00000000FCNI00000-00000.00000-0000000000*01000000FSCI00100-00000.00000-0000000000*01000000ALCI00000-00000.00000-0000000000|Address=::ffff:10.x.x.x^M ^M

2026/07/14_16:55:10.997 info    fds_svrd[4897]: FCP_CONN:: received package ready
2026/07/14_16:55:10.997 info    fds_svrd[4897]: [FMG-->FGT] Response: Protocol=3.2|Firmware=FMG-VM64-KVM-FW-8.00-0155|SerialNumber=FMG-VMTM00000000|Response=300|Persistent=false|ResponseItem=00000000FCNI00000:200*01000000FSCI00100:200*01000000ALCI00000:200^M ^M
2026/07/14_16:55:10.997 info    fds_svrd[4897]: Process client ::ffff:10.x.x.x request SUCCESS
2026/07/14_16:55:10.997 notice  fds_worker[4913]: process remote(::ffff:10.x.x.x) SUCCESS!

Troubleshooting commands:
Debug command on the FortiManager side to validate the updates being pushed or downloaded from FortiGuard:

diagnose fmupdate view-linkd-log fds

Use Ctrl+C to stop the above command logs.

diagnose debug reset
diagnose debug application fdssvrd 255
diagnose debug timestamp enable
diagnose debug en

To stop the above logs and reset the filter applied:

diagnose debug disable 
diagnose debug reset

Debug commands on the FortiFirewall side are as follows:

diagnose debug reset 
diagnose debug application cloudinitd -1
diagnose debug application update -1
diagnose debug application fgfmd -1
diagnose debug console timestamp enable
diagnose debug enable

Related document:
Feature support