FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
nnair
Staff
Staff
Article Id 201970
Description This article describes the time a FortiGate license takes to update.
Scope FortiGate.
Solution

After updating the license on the support portal, it will be necessary to wait 4 to 24 hours until the change is fully reflected.

 

FortiGate requires an internet connection to connect to the FortiGuard server and complete the update process; 

Refer to Technical Tip: Procedure to apply FortiGate firewall license offline for instructions on how to apply the FortiGate license offline.

 

If the license hasn't been updated within 24 hours, follow the steps below to perform preliminary troubleshooting and forward the findings to TAC for additional assistance:

 

The first step in ensuring FortiGuard server connectivity is to confirm successful DNS resolution and connectivity for the following hostname on FortiGate:

 

exe ping service.fortiguard.net
exe ping update.fortiguard.net

 

In a VDOM environment:


config vdom
    edit 'mgmt-vdom-name'


exe ping service.fortiguard.net
exe ping update.fortiguard.net

 

Make sure automatic schedule is enable or not, by default settings will be enabled.

 

config system autoupdate schedule

show full-config

end 

 

Or:

 

diagnose autoupdate status

 

Example:

 

Challenger-kvm19 # diagnose autoupdate status
FDN availability: available at Mon Mar 17 06:06:09 2025
last successful time: Mon Mar 17 06:06:09 2025
Scheduled update: disable
Virus definitions update: enable
IPS definitions update: enable
Web proxy tunneling: disable
DLP Signature status:
DLP signature json file not found.

 

If not enabled, use the below command:

 

config system autoupdate schedule
    set status enable
end

 

To verify the status, run below the command:

 

diagnose autoupdate status

 

Example:

 

Challenger-kvm19 # diagnose autoupdate status
FDN availability: available at Mon Mar 17 06:06:09 2025
last successful time: Mon Mar 17 06:06:09 2025
Scheduled update: enable
Virus definitions update: enable
IPS definitions update: enable
Web proxy tunneling: disable
DLP Signature status:
DLP signature json file not found.

 

Post changes try updating the license manually by pushing FortiGuard updates, with the following command on CLI:

 

diagnose debug application update -1

diagnose debug enable

execute update-now

 

Let these debugs run for some time and at the end of the debugs once 'successful' is seen then the update has been successfully performed.  Then refreshing the GUI should reflect the updated information.

 

upd_comm_disconnect_fds[500]-Disconnecting FDS 173.243.141.6:443
[207] __ssl_data_ctx_free: Done
[1108] ssl_free: Done
[199] __ssl_cert_ctx_free: Done
[1118] ssl_ctx_free: Done
[1099] ssl_disconnect: Shutdown
do_update[711]-UPDATE successful

 

updtae.PNG

 

To stop debugs post updating the license, run the below command:

 

diagnose debug disable 

 

If the licenses have not been updated even after the specified time interval, refer to: Troubleshooting Tip: Diagnosing FortiGuard problems of Antivirus, Intrusion Prevention, Web Filterin...

 

Comments
Debbie_FTNT
Staff & Editor
Staff & Editor

I think you're missing a bit in the 'check the communication' section - those are just two URLs.
I assume the idea is something along the lines of 'execute ping <URL>' to verify connectivity? You could also just link to one of our existing KBs on how to troubleshoot FortiGuard connectivity issues, like https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Diagnosing-FortiGuard-problems-of-An...