Troubleshooting Tip: Understanding and resolving 'duplicate license' errors on FortiAnalyzer and FortiManager VMs

Description

This article explains why administrators might encounter an 'Invalid license Duplicated' or 'duplicate license has been detected' error on FortiAnalyzer and FortiManager Virtual Machines. It covers how the licensing mechanism relies on the VM UUID, the management port IP address, and how FortiGuard validates licenses to prevent reuse across multiple VMs.

Scope

FortiManager VM, FortiAnalyzer VM.

Solution

Background:

When a license is applied to a FortiAnalyzer or FortiManager VM, the FortiGuard distribution network continuously verifies the deployment based on specific environmental identifiers. If FortiGuard detects conflicting data, the system is locked with a duplication error. The verification relies on the following factors:

• VM UUID Binding: The license file is tied directly to the Virtual Machine's UUID. If a VM is cloned, recreated, or migrated to a new hypervisor host and a new UUID is generated, FortiGuard interprets the new instance as a completely separate installation.

• Management Port IP Address: The IP address configured on the device (typically port1) must exactly match the IP address registered on the Fortinet Support Portal.

• FortiGuard Active Verification: FortiGuard servers actively monitor inbound validation requests. If FortiGuard sees concurrent connections using the same serial number but originating from different VM UUIDs, the license is flagged as duplicated. More information how validation works can be found under Technical Tip: FortiManager/FortiAnalyzer-VM License Validation methods.

If a license needs to be migrated to a new VM, or if a duplicate license error must be cleared, the following steps should be taken. As the very first step, it should be verified whether the UUID is correctly generated by the VM:

diagnose debug vminfo
VM license is valid.
fds_code: 200
Type: Full
Licensed GB/Day: 526
Max devices: 10000
Management IP: 193.210.11.1
Serial Number: FAZ-VM0000063000
VM UUID: 8a9f0042-3c08-d95b-184e-b7a848e6211

To verify that the IP address matches, the management interface should be set to static mode:

config system interface
    edit port1
        set mode static
end

Decommission the old VM: Two VMs with the same license cannot be run simultaneously. The old VM must be completely shut down. If it is absolutely necessary to keep the old VM running temporarily to pull configuration data, its DNS settings and route to the internet must be disabled so it cannot communicate with FortiGuard servers.

The FortiCare Support Portal must be accessed to check the IP address bound to the serial number. If the new VM has a different IP address, the IP address on the portal must be manually updated before the license is downloaded.

Wait out the de-registration timer. Once the old VM is powered off, a waiting period of at least 90 minutes is required. This allows the old VM's active session to time out and de-register from the FortiGuard back-end. This is an automated background process and cannot be sped up. If, after 90 minutes, the error message is still not updated, to speed up the process, its possible to manually download the Entitlement file and upload it to FortiAnalyzer or FortiManager before applying the license file again.

After the 90-minute window has passed, the license file can be downloaded from the support portal and uploaded to the new FortiManager or FortiAnalyzer GUI. A reboot of the VM is required to force a fresh validation check.

Note: If communication to the FortiGuard server is not disabled or the old VM is not shut down, the system will allow access to both VMs during a 24-hour grace period. After this period, GUI access may be blocked until the duplicate license error is resolved.