FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Rosalyn
Staff
Staff
Article Id 192610

Description


This article explains how to mitigate the error 'No valid token found - Provision token error: -7567' seen on GUI while assigning FortiToken-Mobile to a user account on the FortiGate.

 

No valid token found.jpg

 

Scope

 

FortiGate.


Solution

 

Possible problems:

  • The most likely cause: FortiGate has no associated FortiToken Mobile license (please check this first in the support portal).

Navigate to support.fortinet.com and check your FortiGate SN. If you see this:

 

In this case, contact Customer Service to assists with migration of the license from the previous device (must provide SN of that device). This does not require a TAC case (not a technical issue)

  • Token not available in the unit (Trial token that does not belong to the current unit)
  • Token not available in the unit (Token that belongs to another unit of a HA cluster of 2-4 FortiGates)

 

Step 1:

Check the available FortiTokens
This command will show all tokens present in the configuration.
Any token SN can be manually added, and does not mean it is available to be assigned):

 

#FGT # diagnose fortitoken info

FORTITOKEN       DRIFT    STATUS
FTKMOB76xxxxxxx1 0    provisioned
FTKMOB98XXXXXD49 0    new
FTKMOB76xxxxxxx3 0    new
FTKMOB76xxxxxxx4 0    new


Step 2:

Check the 'no valid token found' error.

 

#FGT #  diagnose fortitoken debug enable

Debug messages will be on for 30 minutes.
FGT # diagnose debug enable
# ftm_cfg_provision_token[363]:provision token: FTKMOB98XXXXXD49
ftm_fc_provision_token[760]:Provision token: FTKMOB98XXXXXD49
ftm_fc_cfg_set_fd_mgmt_vdom[48]:Using vfid=0 (mgmt:0 ha:3)
ftm_fc_comm_send_request[291]:send packet to forticare success.
 
POST /SoftToken/Provisioning.asmx/Process HTTP/1.1
Accept: application/json, text/javascript, */*, q=0.01
Content-Type: application/json;charset=utf-8
X-Requested-With: XMLHttpRequest
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: 96.45.36.92:443
Content-Length: 405
Connection: Keep-Alive
Cache-Control: no-cache
 
{ "d": { "__type": "SoftToken.ProvisionRequest", "__version": "4", "__device_version": "5.0", "__device_build": "1672", "serial_number": "FG100DxxxxxxxxxA", "__clustered_sns":
[ { "sn": " FG100DxxxxxxxxxA" }, { "sn": " FG100DxxxxxxxxxB" } ], "tokens": [ { "token": " FTKMOB98XXXXXD49", "seed": "A203Dxxxxxxxxxxxxxxxxxx", "code_expire": 4320, "type": "totp", "period": 60, "digits": 6 } ] } }
 
ftm_fc_comm_recv_response[477]:receive packet from forticare success.
 
{"d":{"__type":"SoftToken.ProvisionResponse","__version":"4","serial_number":" FG100DxxxxxxxxxA","__device_version":"5.0","__device_build":"1672","__clustered_sns":
[{"sn":" FG100DxxxxxxxxxB ","error":null},{"sn":" FG100DxxxxxxxxxA", "error":null}],"tokens":[{"token":" FTKMOB98XXXXXD49","license":null,"token_activation_code":null,"qr_code":null,"code_expire":null,"error":{"error_code":31,"error_message":"token does not belong to product"}}],"result":0,"error":{"error_code":17,"error_message":"no valid token found"}}}
 
ftm_fc_command[564]:received error from forticare [-7567]

 

The '-7567' error occurs if the configuration file is restored from a different FortiGate. This includes scenarios like migrating from one FortiGate unit to another manually (modifying the configuration file), using FortiConverter service to migrate configuration, and uploading a configuration file from one firewall to another one with a different serial number. This is only an indicator that the token is not valid for this firewall (not licensed for this device).

 

Each FortiGate comes with 2 free FortiTokens, but after a configuration restore from another unit the free FortiTokens from the original firewall will not be usable, and they can only be removed from the new firewall.

 

Note:

If the FortiGate is running in HA, make sure the FortiTokens license are tied to Primary serial number.

Delete the new FortiTokens on the FortiGate:

 

  1. Login to the GUI, go to:  User & Device -> FortiTokens, select the available Tokens. and delete them
  2. Select 'Create New' and 'Mobile Token' and key in the activation code provided in the PDF file, that is available in the email from do-not-reply-contract@fortinet.com .

jbernabe_0-1712543565077.png

 

  UntitleDDDd1.gif

 

 

If there's no activation code received via email, try to Select 'Import Free Trial Tokens' and Refresh (newer versions will display 'Download' button).

 

Note: 

The 'Import Free Trial Tokens' button only will be shown if there is no any free Fortitokens listed.

 

  1. The deleted FortiToken serial number will appear on the FortiGate again or it will provide a new trial Fortitoken mobile:
 
UntitleDDDd2.gif