Technical Tip: Common issues when registering devices to FortiCloud using FortiOS GUI (FortiGate, FortiAP, FortiSwitch)

[stroia]

Description	This article discusses a variety of issues that can be encountered when attempting to register a new device to FortiCloud. Currently supported devices include the FortiGate, FortiAP, and FortiSwitch.
Scope	FortiGate, FortiSwitch, FortiAP.
Solution	Note that Fortinet devices need to be registered on FortiCloud before receiving technical support.  There are 2 ways to register new Fortinet products: From FortiCloud (also using APIs). From the product GUI or using the GUI of the controller (FortiGate in the case of FortiSwitches and FortiAPs, not standalone).  Refer to the following guides for registering devices through the FortiGate GUI for the three supported products: Registering FortiGate Registering FortiSwitch  Registering FortiAP  If the registration attempt fails, then refer to the list below for common issues during the registration process and how they can be resolved. Trying to register a FortiAP/FortiSwitch through the FortiGate, the Register button is grayed out/inactive. Possible causes: Inactive devices: If the list of devices to be registered includes one or more inactive devices (i.e., red status; not connected to the FortiGate), then the Register button is expected to be grayed out. Go back to the Managed FortiAP or Managed FortiSwitches page and remove the inactive entries from the selection, then retry the registration process. It is only possible to register devices using the FortiGate that are actively connected for management. Registration is stuck due to a connectivity problem: If the Registration field states 'Fetching registration information' for a long period, followed by 'Failed to fetch registration information', as shown here: Refer to the following article: How to fix 'Failed to fetch registration information' error when trying to register FortiSwitch/Fort... If the issue persists, it is necessary to focus on FortiGuard/FortiCloud connectivity troubleshooting: Check if the FortiGate can resolve FortiGuard FQDNs using DNS, such as globalupdate.fortinet.net (anycast FortiGuard) or update.fortiguard.net (unicast FortiGuard). The following documentation lists the FQDNs and IP addresses associated with FortiCloud/FortiGuard services: Anycast and unicast services Technical Tip: IP address and port used for FortiCloud If DNS is resolving correctly, then confirm that basic network connectivity to FortiGuard is also working (e.g. send ICMP pings to FortiGuard using 'exec ping <destination>'). exec ping fds1.fortinet.com exe ping service.fortiguard.net exe ping update.fortiguard.net exe ping support.fortinet.com If the issue persists, here are 2 articles with a complete guide regarding FortiGuard/FortiCloud reachability/connectivity troubleshooting:  Unable to connect to FortiGuard servers   FortiCloud connection failure Solved the problem, the registration procedure via GUI should work, arriving at the last related page:   In earlier versions, registering FortiAPs was not possible if they were managed by a non-management VDOM on the FortiGate (the register button would appear grayed out or unavailable). This issue (#944465) was resolved as of v7.2.6, v7.4.2, and all later revisions. Refer to the following KB article for more information: Technical Tip: How to Resolve FortiCloud Registration Failures for FortiSwitch or FortiAP via FortiG... Note: In some situations, registration from the GUI is not possible, and it does not show a correct registration status. Use CLI commands to verify and complete registration. To register a FortiGate is necessary to execute: diagnose forticare direct-registration product-registration -a <FortiCloud username> -p <password> -T <country> -R <reseller> -e 1 Example: diagnose forticare direct-registration product-registration -a ABC@fortinet.com -p 123456789 -T "UNITED STATES" -R "Other" -e 1 To register FortiSwitch/FortiAP: diagnose forticare direct-registration product-registration -N <FortiSwitch/AP Serial Num.> -a <FortiCloud username> -p <password> -T <country> -R <reseller> -e 1 Example: diagnose forticare direct-registration product-registration -N S424FF111111112 -a ABC@fortinet.com -p 123456789 -T "UNITED STATES" -R "Other" -e 1 If, after selecting the Register button and entering FortiCloud credentials, the registration process continues to fail, with the common error: 'FortiCloud registration failed', here is an additional list of possible causes: FortiAP F-series: If the device being registered is an F-series FortiAP (such as a FortiAP-231F), then check the installed FortiAP firmware version. There is a known issue for F-series FortiAPs that is resolved in FortiAP v6.4.8, v7.0.3, and all later versions. For more information, refer to Technical Tip: 'FortiCloud registration failed' error message when registering 'F' model FortiAPs fr.... Device already registered: If the device is already registered to another FortiCloud account, then this can also cause registration to fail. Refer to the following KB article for steps to confirm and resolve this issue: Technical Tip: FortiAP registration failed via FortiGate In addition to the device transfer via GUI, it is also possible to perform the transfer via FortiCloud, as explained here: Asset Transfer via FortiCloud. License agreement to acknowledge: It has been observed in the past that the GUI method for FortiCloud registration may fail for FortiSwitches. Try performing the registration via the CLI to see if a license agreement needs to be acknowledged, as per the following KB article: Troubleshooting Tip: Error 'FortiCloud Registration Failed' when registering FortiSwitches from Fort... Proxy in the middle: If web traffic coming out from the FortiGate is sent to a third-party device/infrastructure for inspection or proxy, it could be necessary to bypass the third-party infrastructure, sending the registration request directly to FortiCloud. For example, adding an SD-WAN rule on top of the rule steering the HTTP/HTTPS traffic, as explained in his article: Technical Tip: How to create ISDB destination SD-WAN from GUI, using the Internet Service called Fortinet-FortiGuard, and configuring the FortiGate to steer FortiGuard traffic according to SD-WAN rules as explained here: Technical Tip: Use SD-WAN for local out traffic or Management traffic (DNS, NTP, sflow,netflow, LDAP.... Notes: It is not possible to register new devices using the FortiGate GUI if the email address being used is associated with multiple FortiCloud accounts. In cases like these, it is necessary to register the device directly on the FortiCloud website. Related documents: Technical Tip: How to register FortiSwitch to FortiCloud from GUI Troubleshooting Tip: FortiSwitch Registration Status is displayed as 'not registered' after FortiGat... Registering your FortiManager-VM  Troubleshooting Tip: The product serial number has already been registered - FortiManager/FortiAnaly...