Skip to main content
Raj_Pandey
Raj_Pandey
Explorer
November 27, 2025
Solved

Reassigning/Transferrig FortiGate-VM Licenses Between Two HA Clusters (Cluster-A HA & Cluster-B HA)

  • November 27, 2025
  • 1 reply
  • 869 views

Environment

We have two separate FortiGate-VM HA clusters:
Cluster-A (VM-A-HA): 2 nodes (active–passive)
Cluster-B (VM-B-HA): 2 nodes (active–passive)
Both clusters run FortiGate-VM BYOL licenses (one license per VM node).

Background / What Happened

The licenses on both nodes of Cluster-B expired.
To maintain service availability, we performed a temporary workaround:
Powered off both nodes of Cluster-A.
Downloaded the valid license files for both nodes of Cluster-A from the FortiCare portal.
Uploaded these two licenses respectively to the two nodes of Cluster-B.
Cluster-B resumed normal operation with those temporarily reassigned licenses.
Cluster-A has remained powered off since the license transfer.

Current Situation
We have now purchased new licenses (one per node) for Cluster-B.

Our intention is to:

Apply the new licenses to both nodes of Cluster-B
Restore the original Cluster-A licenses back to the two nodes in Cluster-A
Bring both clusters back into healthy HA state with proper licensing.


Before doing this, we require suggestion/validation to avoid backend conflicts, duplicate-license errors, HA mismatches, or FortiGuard issues. #fortigate

Best answer by esalija

Hi @Raj_Pandey 

- For minimal disruption, upload the new license to the secondary firewall in Cluster-B first.

- This approach allows the secondary unit to reboot and update without affecting the active traffic flow.- 

- Once the secondary unit is updated and stable, proceed to upload the license to the primary firewall.

- This sequence helps maintain service availability during the update process.

 

Thanks, Erlin

1 reply

esalija
Staff
esalija
Staff
November 28, 2025

Hi @Raj_Pandey 

- To ensure a smooth transition and avoid any conflicts or errors, follow these steps:

- Prepare New Licenses for Cluster-B:
Download the new licenses for both nodes of Cluster-B from the FortiCare portal.

- Apply New Licenses to Cluster-B:
Shut down both nodes of Cluster-B to ensure the existing temporary licenses are removed from FortiGuard Servers. Keep them shut down for at least 90 minutes.
Upload the new licenses to both nodes of Cluster-B simultaneously to maintain HA consistency.

- Restore Original Licenses to Cluster-A:
Ensure Cluster-A nodes remain powered off for at least 90 minutes to clear any license data from FortiGuard Servers.
Upload the original licenses back to the nodes of Cluster-A.

- Power On and Verify:
Power on both clusters and verify that each node is operating with the correct license.
Check the HA status to ensure both clusters are in a healthy state.

- Monitor for Errors:
Monitor the system logs for any 'Duplicate license detected' errors or other issues.
Ensure FortiGuard services are functioning correctly on both clusters.
- By following these steps, you should be able to restore both clusters to a healthy state with proper licensing.

 

Best regards,

Erlin

    Raj_Pandey
    Raj_PandeyAuthor
    Explorer
    November 28, 2025

    @esalija

    Thanks a lot for your response and the clarity. However, I have one more question.
    If I upload the newly purchased license directly to Cluster-B, will it override the existing license on Cluster-B and change the serial number? After that, I plan to power on Cluster-A, since Cluster-B would already have the new license I uploaded, and Cluster-A could then retain its old license. This approach should allow us to keep the outage window minimal without disrupting the current traffic flow.

    I am asking about this behavior because Cluster-B is in production, and we need to maintain minimal downtime. For Cluster-A, I can wait for 90 minutes. What do you suggest—can I proceed this way?

    esalija
    Staff
    esalija
    Staff
    November 29, 2025

    Hi @Raj_Pandey,

     

    Yes, you can proceed with uploading the newly purchased licenses directly to Cluster-B.

    1. Upload the new licenses to both nodes of Cluster-B. This will override the existing temporary licenses and update the serial numbers accordingly.
    2. Ensure that both nodes in Cluster-B are synchronized and functioning correctly after the license update.
    3. Once Cluster-B is stable with the new licenses, power on Cluster-A.
    4. Since Cluster-B now has its own valid licenses, Cluster-A can retain its original licenses without conflict.
    5. After powering on Cluster-A, verify that both clusters are operating correctly with the appropriate licenses.
    6. Check the HA status and ensure that FortiGuard services are functioning as expected.

    Thank you,
    Erlin

      Terms & ConditionsAccessibility statement