Fortigate VM subscription

You shouldn't lose configuration if license expires you can always renew it.
but FW won't be active anymore, you can just save a backup of the config file.
and if only part of the license expires for example web filter and so on then those services won't work anymore.

Hi CL,

I'm assuming you mean the BYOL s-series. Unlike a perpetual BYOL, s-series service and device entitlements are bundled together and the subscription VM stops passing data traffic when its license is expired. It's not possible to manage it using the GUI to backup the configuration once that occurs.

It is possible to use SSH or console (if console is available through your VM hosting solution) to access the device and retrieve configuration, or backup the configuration to a remote server over ftp/sftp using the 'execute backup config <arguments>' command. However, care should be taken when attempting this since the configuration file is sensitive- for example don't transmit it using FTP over untrusted networks.

There is the 30 day grace period if the device has no access to FortiGuard (see VM license), but I haven't been able to verify if that applies for devices with no network issue, or indeed if it applies to devices that develop a network issue after the license is expired.

Regards,
Matt_B