Skip to main content
dostap
dostap
Visitor III
February 25, 2026
Question

Couldn't connect Fortigate-VM to Fortimanager (trial licenses)

  • February 25, 2026
  • 9 replies
  • 1002 views

I try to connect Fortigate-VM (v7.4.11 build2878) to Fortimanager VM (v7.6.6 build3654) both of them have trial licenses in the same account. If I try to connect from Fortigate side I get error "The FortiManager's access to the FortiGate will be authenticated by the FortiManager certificate. The serial number from the certificate must match the serial number observed on the FortiManager. Could not connect to the FortiManager to retrieve its serial number."  If I try to connect from Fortimanager as discover online device I get error "Probe failed" after Fortigates login and password entering. Both VMs placed in the same subnet and have fresh installation and only one configured interface and have internet access. FMG-Access enabled on Fortigate's interface.

On FortiManager side I configure the follow:

"

FMG-VM64 # config system global

(global)# show
config system global
set adom-rev-auto-delete disable
set enc-algorithm low
set fgfm-allow-vm enable
set fgfm-ssl-protocol tlsv1.0
set usg enable
end

"

Fortigate has the same settings:

FGVMEVTVNNOV_SCF (global) # show
config system global
set alias "FGVMEVTVNNOV_SCF"
set gui-auto-upgrade-setup-warning disable
set hostname "FGVMEVTVNNOV_SCF"
set management-ip "10.100.31.49"
set ssl-min-proto-version TLSv1
set timezone "Europe/Kyiv"
end

 

FGVMEVTVNNOV_SCF (central-management) # show full
config system central-management
set mode normal
set type none
set schedule-config-restore enable
set schedule-script-restore enable
set allow-push-configuration enable
set allow-push-firmware enable
set allow-remote-firmware-upgrade enable
set allow-monitor enable
set local-cert ''
set vdom "root"
set fmg-update-port 8890
set include-default-servers enable
set enc-algorithm low
end

 

FGVMEVTVNNOV_SCF # get system status

...

License Status: Valid
VM Resources: 1 CPU/1 allowed, 1993 MB RAM/2048 MB allowed

 

In "Firmware&Registration" page on Fortigate I see "Not registered" in registration status and couldn't complete manual registration (resseller list isn't load). I think it's trial license limitation.

 

I try Fortigate-VM (v7.6.6 build3652) to connect to FortiManager but situation exactly the same.

 

How I can resolwe this issue?

 

Thanks.

 

9 replies

sw2090
SuperUser
sw2090
SuperUser
February 25, 2026

I don't think its a license limitation on FGT side. I can even add FortiGates to our FOrtimanager which don't have any valid licenses on them.

The only limit that would hit me here would be the licensed device limit in FMG.

 

you could try to debug fgfm (diag debug app fgfmd 255) to see if it reports any issues.

I encountered the "probe failed" error various times here and mostly it was due to FGM not enabled on the FGT interface (or enabled on more than one interface) or the FGT failing the automatic interface selection (can be workaed around by manually setting fmg-source-ip on cli).

dostap
dostapAuthor
Visitor III
February 25, 2026

Thanks for your answer. 

On my Fortigate FMG-Access enabled on correct and single interface:

 

Screenshot 2026-02-25 160431.png

 

diag debug app fgfmd 255 output (this one repeats all time during debug enabled): 

 

2026-02-25 15:53:29 FGFMs: __detect_fmg_create: start a new detect request(10.100.31.45)
2026-02-25 15:53:29 FGFMs: Create session 0x55b15dcf5ec0.
2026-02-25 15:53:29 FGFMs: setting session 0x55b15dcf5ec0 exclusive=0
2026-02-25 15:53:29 FGFMs: Connect to 10.100.31.45:541, local 10.100.31.49:4743.
2026-02-25 15:53:29 FGFMs: set_fgfm_sni SNI<support.fortinet-ca2.fortinet.com>
2026-02-25 15:53:29 FGFMs: Load Cipher [DES:!ECDH:!DHE:!3DES:!AES:!CAMELLIA:!SEED:!RC4:!PSK:!IDEA:!ARIA:@STRENGTH:@SECLEVEL=0]
2026-02-25 15:53:29 FGFMs: Load TLS 1.3 Cipher [TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256]
2026-02-25 15:53:29 FGFMs: __handle_detect_fmg_req: detect session to 10.100.31.45 doesn't exist, start a new one
2026-02-25 15:53:29 FGFMs: before SSL initialization
2026-02-25 15:53:29 FGFMs: CA to broadcast: subject fortinet-subca2003, issuer fortinet-ca2
2026-02-25 15:53:29 FGFMs: CA to broadcast: subject support, issuer support
2026-02-25 15:53:29 FGFMs: CA to broadcast: subject fortinet-ca2, issuer fortinet-ca2
2026-02-25 15:53:29 FGFMs: CA to broadcast: subject fortinet-subca2001, issuer fortinet-ca2
2026-02-25 15:53:29 FGFMs: Broadcast 4 CA subject names to FMG
2026-02-25 15:53:29 FGFMs: SSLv3/TLS write client hello
2026-02-25 15:53:29 FGFMs: SSLv3/TLS write client hello
2026-02-25 15:53:29 FGFMs: SSLv3/TLS read server hello
2026-02-25 15:53:29 FGFMs: SSLv3/TLS write change cipher spec
2026-02-25 15:53:29 FGFMs: SSLv3/TLS write client hello
2026-02-25 15:53:29 FGFMs: SSLv3/TLS write client hello
2026-02-25 15:53:29 FGFMs: SSLv3/TLS read server hello
2026-02-25 15:53:29 FGFMs: TLSv1.3 read encrypted extensions
2026-02-25 15:53:29 FGFMs: SSLv3/TLS read server certificate request
2026-02-25 15:53:29 FGFMs: SSLv3/TLS read server certificate
2026-02-25 15:53:29 FGFMs: TLSv1.3 read server certificate verify
2026-02-25 15:53:29 FGFMs: The subject CN in peer's certificate: FMG-VMTM26002636
2026-02-25 15:53:29 FGFMs: The issuer CN in peer's certificate: fortinet-subca2001
2026-02-25 15:53:29 FGFMs: SSLv3/TLS read finished
2026-02-25 15:53:29 FGFMs: SSLv3/TLS write client certificate
2026-02-25 15:53:29 FGFMs: SSLv3/TLS write certificate verify
2026-02-25 15:53:29 FGFMs: SSLv3/TLS write finished
2026-02-25 15:53:29 FGFMs: SSL negotiation finished successfully
2026-02-25 15:53:29 FGFMs: client:send:
get auth
serialno=FGVMEVTVNNOV_SCF
mgmtid=00000000-0000-0000-0000-000000000000
platform=FortiGate-VM64
fos_ver=700
minor=4
patch=11
build=2878
branch=2878
maxvdom=2
fg_ip=10.100.31.49
hostname=FGVMEVTVNNOV_SCF
harddisk=yes
biover=04000002
harddisk_size=30720
logdisk_size=30063
mgmt_mode=normal
enc_flags=0
mgmtip=10.100.31.49
mgmtport=443


2026-02-25 15:53:29 FGFMs: SSL negotiation finished successfully
2026-02-25 15:53:29 FGFMs: SSL negotiation finished successfully
2026-02-25 15:53:29 FGFMs: SSLv3/TLS read server session ticket
2026-02-25 15:53:29 FGFMs: SSL negotiation finished successfully
2026-02-25 15:53:29 FGFMs: SSL negotiation finished successfully
2026-02-25 15:53:29 FGFMs: SSLv3/TLS read server session ticket
2026-02-25 15:53:30 FGFMs: Cleanup session 0x55b15dcf5ec0, 10.100.31.45.
2026-02-25 15:53:30 FGFMs: Destroy session 0x55b15dcf5ec0, 10.100.31.45.

dostap
dostapAuthor
Visitor III
February 25, 2026

On Fortimanager "diag debug app fgfmd 255" output I had seen this one:

 

2026-02-25 16:22:14 __on_handshake,457: accept from peer:10.100.31.49, me:10.100.31.45
2026-02-25 16:22:14 FGFMs(probing...): 2026-02-25 16:22:14 server:
2026-02-25 16:22:14 FGFMs(probing...): 2026-02-25 16:22:14 get auth
serialno=FGVMEVTVNNOV_SCF
mgmtid=00000000-0000-0000-0000-000000000000
platform=FortiGate-VM64
fos_ver=700
minor=4
patch=11
build=2878
branch=2878
maxvdom=2
fg_ip=10.100.31.49
hostname=FGVMEVTVNNOV_SCF
harddisk=yes
biover=04000002
harddisk_size=30720
logdisk_size=30063
mgmt_mode=normal
enc_flags=0
mgmtip=10.100.31.49
mgmtport=443


2026-02-25 16:22:14 __get_handler:1039: peer_sn=FortiGate, msg_sn=FGVMEVTVNNOV_SCF, session_cn=FortiGate
2026-02-25 16:22:14 __get_handler:1082: serial number (FGVMEVTVNNOV_SCF) in 'get' message doesn't match the subject CN (FortiGate) in peer's certificate.

2026-02-25 16:22:14 FGFMs(probing...): 2026-02-25 16:22:14 Destroy session 0x556167e7a93c, 10.100.31.49.
2026-02-25 16:22:14 FGFMs(probing...): 2026-02-25 16:22:14 Cleanup session 0x556167e7a93c, 10.100.31.49.
2026-02-25 16:22:14 proxy_session.c,__proxy_read,167: backend eof.
2026-02-25 16:22:14 proxy_session.c,__proxy_session_cleanup, 120:cnt=0, session=0x5561689ac03c.

 

I think it's a reason of my issue. 

How can I generate valid certificate with CN=FGVMEVTVNNOV_SCF on my Fortigate and assign it for Fortimanager connection?

sw2090
SuperUser
sw2090
SuperUser
February 25, 2026

you could generate or import a certificate on the FGT that has the Serial as CN.

Then you could tell the FGT to use that to talk to FMG - this step can however only be done on FGT command line):

 

config system central-management

  set local-cert Certificate to be used by FGFM protocol.
  set ca-cert CA certificate to be used by FGFM protocol

end

 

dostap
dostapAuthor
Visitor III
February 25, 2026

Unfortunately I can't generate certificate with Serial as CN on Fortigate - "The common name should match the FQDN or IP of the primary SSL-VPN interface." It's very strange but for trial lab I should deploy myown CA. Is there another way for resolve the issue?

farhanahmed
Staff
farhanahmed
Staff
February 25, 2026

Refer to the 'Scenario 3' in article below and see that fixed the cert CN issue:

https://community.fortinet.com/t5/FortiManager/Troubleshooting-Tip-Common-issues-while-adding-FortiGate-to/ta-p/396147

www.farhan.ch
dostap
dostapAuthor
Visitor III
February 26, 2026

I had tried to do these steps but CN hadn't changed.

 

FGVMEVTVNNOV_SCF # execute vm-license FGVMEVTVNNOV_SCF
This operation will reboot the system !
Do you want to continue? (y/n)y

Failed to download VM license.

 

Then I uploaded trial license file, VM rebooted bun nothing changed.

 

And I executed command: execute vpn certificate local generate default-ssl-key-certs but result was the same.

 

 

farhanahmed
Staff
farhanahmed
Staff
February 26, 2026

Strange.

You can then generate custom certs.

Use the article below to to generate custom certs (doc is for FAZ but use came process for FMG):
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Certificate-Generation-with-FIPS-Enabled-on/ta-p/298601

Then use the certs for FGFM:
https://community.fortinet.com/t5/FortiManager/Technical-Tip-Setup-custom-certificate-for-FGFM-protocol/ta-p/242730 

www.farhan.ch
Terms & ConditionsAccessibility statement
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!