Technical Tip: What to do with a FortiGate device flagged as FC_UNREG and placed in the 'Unregistered with FortiCare' group
Description
This article describes what to do with a FortiGate device flagged as FC_UNREG and placed in the 'Unregistered with FortiCare' group.
Scope
FortiManager v7.6.7+, FortiGate.
Solution
When FortiManager checks devices as described in Managing FortiGate registration to FortiCare, FortiManager will check the device's FortiCare contract status: if the device is unregistered with FortiCare, it is automatically assigned to a group of devices called 'Unregistered with FortiCare'.
The administrator can also check the FortiCare status for all devices from the CLI of the FortiManager:
diagnose dvm device list
Download the generated output file (e.g. in a file called console_history_date) and grep the chain 'FC_UNREG' from it using this command:
linux$ grep -B1 FC_UNREG console_history_*
FC_UNREG is the CLI status code that indicates a FortiGate device is not registered with FortiCare (Fortinet's support and licensing database).
To resolve the issue:
Check registration of the device with FortiCare.
Connect to Support and look for the serial number of the FC_UNREG device.
Why FortiGate devices can show as Unregistered:
When FortiGate devices are first added to FortiManager, FortiManager checks the device's FortiCare contract status. The device will show as 'Unregistered with FortiCare' if:
The FortiGate has never been registered with FortiCare.
The registration has expired or been removed.
The serial number is not found in the FortiCare database.
The device was recently added to FortiManager before registration was completed.
Look at Product registration with FortiCare to manage registration of each individual device (two or more in case of a cluster).
Check FortiGuard direct connectivity.
Since FortiOS v7.2, the FortiGate requires access to the FortiGuard server to verify its license and register.
Use the following commands to verify FortiGuard Servers access:
FGT# show system fortiguard
FGT# diagnose autoupdate status
FGT# diagnose autoupdate version
FGT# get system fortiguard-service status
FGT# diagnose test update info
FGT# diagnose debug rating
FGT# execute ping service.fortinet.com
FGT# execute ping update.fortiguard.net
FGT# execute ping service.fortiguard.net
Always think about intermediate devices that can filter the FortiGuard traffic or routing issues (selecting outgoing interface to initiate connection to the FortiGuard servers hosted on Internet). See the related articles below.
Check FDS direct connectivity.
In Air-Gapped environments, a FortiManager can be configured to act as a FortiGuard Distribution System (FDS) when FortiGates are not allowed to reach Internet.
To show the configuration:
FGT# show sys central-management
See this article for appropriate configuration tips: Technical Tip: How to setup FortiGate to get updates from FortiManager.
Once connectivity between the FortiGate and the FortiManager are verified, connectivity between FortiManager and the Internet's FortiGuard servers also needs to be checked:
FMG# diagnose fmupdate view-serverlist fds
FMG# diagnose fmupdate update-status fds
FMG# diagnose fmupdate dbcontract
Check the license for the FortiGate is present in the FortiManager under FortiGuard -> Device Licenses.
Select the 'Check License' button and wait to see the device in the updated list.
Temporary workaround.
As a temporary workaround, the administrator can download the license file from the FortiCare portal and import it on the FortiGate GUI. This article describe a necessary prerequisite: Customer Service Tip: How to enable the Entitlement File Download feature in Support Portal.
Related articles: