| Description |
The article describes why FortiGate records some Event Logs, saying that the FortiGuard license has expired.
It explains what happens if the FortiGuard contract expires, and what happens if the FortiGate license expires.
|
| Solution |
The log messages may appear due to one or more of the following reasons:
- The Trial or Evaluation period has expired: When the status of FortiGuard-Web or FortiGuard-AntiSpam is checked on the GUI or activate one (or more) of these for the first time, a 30-day trial period for the respective feature begins. After the trial period, log messages such as the following will begin to appear, notifying the user that the Trial is over.
2016-03-07 09:17:07 device_id=FGTxxxxxxxxxxxxx log_id=0100020101 type=event subtype=system pri=critical msg="Fortiguard license is expired"
- Contract is over: If a FortiGuard Contract is purchased, and the FortiGuard contract is not renewed, the log messages like the one below indicate that the FortiGuard license has expired:
2016-03-01 21:35:58 device_id=FGTxxxxxxxxxxxxx log_id=0100020101 type=event subtype=system pri=critical msg="Fortiguard license is expired"
What happens if the FortiGuard contract expires:
If the license is not renewed, the following features will stop working:
- FortiGuard web filter will lose connection, so FortiGuard category-based web filtering will stop working (policies, where the Web filter is applied, will block traffic), user may need to remove Web Filter profile to pass the traffic.
However, if there is Static URL filtering applied, that will still work as per the configured entries.
- AV and IPS scanning will continue to work, but the signature databases will not be updated on the FortiGate.
This is very important as the firewall will no longer offer protection against new threats including zero day threats.
- Any feature that requires connectivity with the FortiGuard network will no longer work, like, DNS filtering and App control.
- FortiGate-VM licenses will lose GUI access for management (limited only to uploading a new license file). CLI access is allowed.
- The frewall cannot upgrade to the next minor or major firmware version. However, FortiGate will enforce an automatic update to the latest patch of the current minor version. This also applies if the appliance has reached End of Support (EOS).
Additional Note:
- The GUI will show status as 'License expired'.
- Use the following commands for debug:
diagnose debug app update -1
diagnose debug enable
To stop it:
diagnose debug disable
- After renewal, a reboot may be necessary in some cases to restore full functionality.
To check updated license information, use the following command:
diagnose test update info
For a detailed description of the expiration impact for each license type, see License expiration.
Note:
In certain (older) FortiOS builds, these messages may be displayed even if the contract is valid. Those versions are no longer supported. Update to a supported FortiOS version first. See Product Life Cycle.
|
