Technical Tip: FortiGate stucks in Validating License screen ('License is being validated by FortiGuard')

[ezhupa]

Description	This article describes the case when FortiGate GUI is stuck with the error 'License is being validated by FortiGuard'.  In a normal operation, after uploading the license or launching a VM for the first time, a prompt on the GUI about the license being validated by the FortiGuard server: A successful license validation allows to log in to FortiGate’s GUI: However, it is possible to encounter the issue where the first screen loads for a long time, in which it will show a button to select on the CLI console to check the network connection.
Scope	FortiGate.
Solution	Make sure the following requirements are met for the connection to the FortiGuard: Internet must be reachable: try to ping public DNS servers like 8.8.8.8, 1.1.1.1, 8.8.4.4. Make sure that the firewall can resolve the domain name: try to ping: execute ping service.fortiguard.net And: execute ping update.fortiguard.net If both requirements above are met, run the below commands to troubleshoot FortiGate - FortiGuard communication: diagnose debug application update -1 diagnose debug enable execute update-now Leave it running for a couple of minutes. To disable it, type this command:  diagnose debug disable Check the debug output for different scenarios:  FortiGuard is not reachable via the default Anycast method: following this article to adjust the FortiGuard setting as necessary: Technical Tip: FortiGuard is not reachable via Anycast default method Cert error 9, a certificate is not yet valid: 2022-01-11 14:06:17 [360] __ssl_crl_verify_cb: Cert error 9, certificate is not yet valid. Depth 0 2022-01-11 14:06:17 __upd_peer_vfy[329]-Server certificate failed verification. Error: 9 (certificate is not yet valid), depth: 0,  2022-01-11 14:06:17 [1013] ssl_connect: SSL_connect failes: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed 2022-01-11 14:06:17 ssl_connect_fds[392]-Failed SSL connecting (5,0,Success) Error: 9 (certificate is not yet valid) Then it will be necessary to check the FortiGate system time. Refer to the below KB article to adjust the date/time settings on the FortiGate: Technical Tip: Setting the system time. After adjusting the settings the validation will go through. Failed connecting after sock writable: upd_comm_connect_fds[455]-Trying FDS [2620:101:9000:140:173:243:140:6]:443 tcp_connect_fds[265]-Failed connecting after sock writable upd_comm_connect_fds[469]-Failed TCP connect upd_act_HA_contract_info[714]-Error updating FSCI -1 Try to explicitly specify the interface to connect to the FortiGuard server by executing the following commands: config system fortiguard     set interface-select-method specify (the default option is auto)     set interface <WAN-interface> end Check the update debug again to see if the FortiGuard servers are reachable now. If not, open a case with TAC for further assistance: https://support.fortinet.com/welcome/#/ DNS not reachable: upd_fds_load_default_server6[1046]-Resolve and add fds usupdate.fortinet.net ipv6      address failed. upd_fds_create_list[1295]-No server found for update[00000001] do_setup[348]-Failed setup Try to check DNS connectivity with FortiGate. Refer to the following KB article to bring DNS connectivity back on the FortiGate: Technical Tip: DNS stops working when using custom DNS. It is worth checking if any proxy is configured for FortiGuard connectivity. The same way a source-ip is specified for different FortiOS services (DNS, FortiGuard, Syslog etc), a proxy can be configured to tunnel traffic from FortiGate to FortiGuard through a proxy appliance. This feature was introduced in FortiWeb appliances and is also available on all FortiOS versions.     config system autoupdate tunneling         set status enable         set address '10.10.10.1'         set port 8080         set username 'test'         set password test     end Disable this feature and test if FortiGuard is reachable to get licence information     config system autoupdate tunneling         set status enable     end If all of the above have been checked and the issue still persists, try to run the following command: execute vm-license <token> Note: This command will require a reboot of the FortiGate so make sure to run it out of business hours or during a maintenance window. This command will manually download the VM license and can help in cases when the issue is caused by the built-in certificates of the FortiGate VM.