Skip to main content
cmaheu
Staff
cmaheu
Staff
May 13, 2021

Troubleshooting Tip: Entitlements not applied after installing subscription license key

  • May 13, 2021
  • 1 reply
  • 4227 views

Description


This article describes the causes behind an issue where entitlements are not applied after installing a subscription license key. 

Symptoms:

  • License Information Dashboard panel displays BASE level license.
  • 'licensetool -key EFFECTIVE' CLI command displays BASE level license.


Scope

 

FortiNAC version 8.x, 9.x, F7.x.


Solution

 

Verify whether or not the appliance can successfully reach FortiCloud for entitlement information.  Login to the appliance CLI as root and type the following depending on operating system:
 
CentOS:
 
entitlementstool -poll
 
FortiNAC-OS:
 
diagnose system entitlements -poll
 
Note:
 
This command without the 'poll' option returns cached entitlement information.
 
The resulting output should display the appropriate entitlements.
 
Example output:

description supportLevelDescription expirationDate
__________________________ _______________________ ______________
Telephone Support 24x7 2027-04-08
FortiNAC VM FortiNAC Pro 2024-04-08
IoT Detection Web/Online 2027-04-08
Vulnerability Management Web/Online 2027-04-08
Firmware & General Updates Web/Online 2027-04-08
Enhanced Support 24x7 2027-04-08
COMP 24x7 2027-04-08
Effective Count=500
Effective Level=PRO
 
Polling returns with incorrect entitlements: Login to the Customer Portal and verifies License entitlements. For assistance, contact Customer Service.
 
No entitlements are displayed or the prompt is never returned: This suggests the appliance cannot communicate with FortiCloud. 
 
  1. FortiNAC polls fds1.fortinet.com using TCP port 443. Ensure this port is allowed outbound to the internet from eth0. Refer to the Open Ports section of the Deployment Guide.
  2. Ensure the appliance can resolve the name fds1.fortinet.com.
  3. Verify entitlements are applied once the poll is successful. Type the following:
 
CentOS:
 
licensetool -key EFFECTIVE
 
FortiNAC-OS:
 
get system license -key EFFECTIVE
 
The entitlements should now display. 
 
Results still show BASE level entitlements (Virtual Appliance): 
 
Example output:

EFFECTIVE:
serial = FNVMCATMxxxxxxxxx
type = NetworkControlApplicationServer
level = BASE
count = 0
expiration = 0
expired = false
mac = <MAC address>
uuid = <UUID>
certificates = [xxxxxxxxxxxxxxxxxxx, xxxxxxxxxxxxxxxxxxxxx]

 

  • Verify the key has certificates: The poll function uses the serial number to look up entitlements. To apply the entitlements, there is a certificate included in the key that must be present. Possible certificate related causes: 

 

Certificate is missing:

 

Certificates in the Key are not complete: 

  • Example:  certificates = [xxxxxxxxxxxxxxxxxxx, xxxxxxxxxxxxxxxx]. The certificate will not be validated and entitlements will not be applied.
  • The license key content may have been truncated during license installation.
  • Re-download the key from the customer portal and re-install using the Administration UI. For instructions, see License management in the Administration Guide. 

 

If copying and pasting the key content, ensure all characters have been copied. 

To avoid the risk of truncation, upload the text file itself.   

 
Results still show BASE level entitlements (Hardware Appliance): 
 
Possible cause: Applies for FortiNAC CentOS appliances only: The shipped key file is missing certificates. 
 
To verify, use the following command:
 
CentOS:
 
licensetool -key FILE -file /bsc/campusMgr/.licenseKeyHW
 
Example of a key file missing certificates:
 
FILE:
serial = FN5HCATAxxxxxxxx
type = NetworkControlApplicationServer
level = BASE
count = 0
expiration = 0
expired = false
mac = xx:xx:xx:xx:xx:xx
uuid = 00000000-0000-0000-0000-000000000000
                <- There should be a certificate line here.
 
Solution:  If certificates are missing from the .licenseKeyHW file or if .licenseKeyHW is missing entirely, the FortiNAC unit must be RMA'ed.
 

Additional debugging.

 

  1. Enable debugging. Use the following commands:

 

CentOS:

 

nacdebug -name EntitlementServer true
nacdebug -logger yams.FCPClient -level FINEST

 

FortiNAC -OS:

 

diagnose debug logger set finest yams.FCPClient

 

  1. Poll for entitlements

 

CentOS:

 

entitlementstool -poll

 

FortiNAC-OS:

 

diagnose entitlements -debug

 

  1. Collect logs.

 

Version 8.x:

 

grab-log-snapshot

 

Versions 9.x/F7.x:  Use the Download logs option in the UI. For instructions, see Download logs in the Administration Guide.

 

  1. Disable logging.

 

CentOS:

 

nacdebug -logger yams.FCPClient

nacdebug -name EntitlementServer false


FortiNAC-OS:

 

diagnose debug logger unset yams.FCPClient

 

  1. Open a support ticket and include the following:
  • FortiNAC version:
    • 8.x: Help -> About.
    • 9.x/7.x: Dashboard (System Summary widget).
  • Troubleshooting steps taken.
  • Version 8.x:  Resulting .gz file from step 3 (located in /tmp).

 

Related articles:

Technical Note: UI does not list serial number or license entitlements.

Technical Tip: Endpoint licensing and license upgrades.

1 reply

Debbie_FTNT
Staff & Editor
Debbie_FTNT
Staff & Editor
November 25, 2021

Hey @cmaheu,

 

maybe a note adding that "entitlementstool" (without the -"poll" parameter) returns information on the support entitlements, and "-poll" is only required if the information FortiNAC has on its support entitlements needs to be updated?

 

Cheer!

Terms & ConditionsAccessibility statement