Technical Tip: Understanding FortiProxy license sharing: Key concepts, configuring license sharing settings, and CLI verification commands
| Description | This article describes the FortiProxy license-sharing feature, including key terminology and essential CLI commands to verify the license-sharing status on both root and downstream devices within a Security Fabric group. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Scope | FortiProxy v7.4.x and later (hardware and VM). All models that support Security Fabric with license sharing are enabled. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Solution | The following CLI commands are essential for verifying the license-sharing configuration, status, and health on both root and downstream devices (security fabric).
Command: get system csf. Run on: Root or downstream. Displays the Security Fabric group settings, including fabric name, license-sharing status, trusted member list, and configuration-sync mode. Verify that license-sharing is set to enable and the downstream devices are listed in the trusted-list.
get system csf status : enable upstream : group-name : my_fabric_grp group-password : * downstream-access : enable license-sharing : enable configuration-sync : local trusted-list: == [ 1 ] name: 1 serial: FPX*************
Command: diagnose wad license. Run on: Any device in the fabric group. Shows the local license sharing mode, seat counts, and session utilization for the device where the command is run. This is the primary command to confirm whether a device is connected to the fabric and whether its local license can sustain the current workload independently.
diagnose wad license Lic Sharing mode: fabric Lic type furl: Model Max Seat: 25000 Active Seat: 1373 Available Purchased Seat: 5500 Available Fabric Seat: 1373 Available HA Seat: 8500 License Seats Registered: FPX1************: 5500 FPX2************: 3000 Max Licensed Session: 34325 Current Licensed Sessions: 29028 Max bypassed Sessions: 0
Key fields to check:
Command: diagnose test app csfd 140. Run on: Root device only. This is the most comprehensive view of the entire fabric license pool. It shows purchased, used, and allocated seats for every authorized and connected device in the group, along with device health indicators (stale, conserve, sharing status). The root device entry also displays the fabric-wide totals.
diagnose test app csfd 140 dev: FPX*************(0x61abe40), stale: n, root: n, sharing: y, last ping: 1773221050 lic purchased/ used/ allocated/ reserved/guaranteed/ preferred/ model_max/grant?/conserve furl 8500/ 1141/ 1373/ 2/ 0/ 0/ 25000/ no / no fnbi 0/ 0/ 15/ 15/ 0/ 0/ 625000/ no / no fcas 0/ 0/ 2/ 2/ 0/ 0/ 625000/ no / no
dev: FPX*************(0x61abd70), stale: n, root: y, sharing: y, last ping: 1773221035 lic purchased/ used/ allocated/ reserved/guaranteed/ preferred/ model_max/grant?/conserve furl 501/ 0/ 2/ 2/ 0/ 0/ 6000/ no / no
Total: lic purchased/ used/ allocated/ conserve furl 17501/ 2140/ 2516/ no
Key fields to check per device:
Command: diagnose system csf downstream. Run on: Root device. Lists all connected downstream member devices regardless of authorization status. Use this to confirm that downstream devices are visible to the root.
Command: diagnose system csf upstream. Run on: Downstream device. Shows the connection status to the fabric root from the downstream perspective. The status should show Authorized. If it shows Authorization Rejected, verify that the device serial is added to the trusted-list on the root.
Command: diagnose wad license usage [seconds | minutes | hour | day | week | year]. Run on: Any device. Displays the local license usage history at the specified interval. Useful for identifying peak usage patterns before planning maintenance or upgrades.
Command: diagnose wad license glob-usage [seconds | minutes | hour | day | week | year]. Displays the global (fabric-wide) license usage history. Run this on the root to understand overall pool utilization trends.
Command: diagnose wad license clear. Clears all license usage history data. Can be used to reset usage tracking after changes.
CLI Quick Reference summary. The following table provides a quick reference of all key commands and where to run them:
Related document: |