Description
This article describes how the license entitlements for the FortiGate (including FortiGuard services/updates and technical support) will show different expiration dates depending on where they are checked (FortiGate CLI/GUI vs. FortiGate debugs vs. Fortinet Support site).
Scope
FortiGate, Licensing.
Solution
In general, the following pattern has been observed with regard to how service expiration dates are shown in various places on the FortiGate and on the Fortinet Support site:
When checking the Fortinet Support Site (aka FortiCare/FortiCloud), the Expiration Date shown in the FortiGate's Asset Management entry will be the actual contract expiry date (T+0).
- In the following example screenshot, the Advanced Malware Protection license (AMP, which includes Antivirus) has an expiration date of 2026-03-12:
When checking from the FortiGate CLI/GUI, the date will be the actual contract expiry date plus one day (T+1):
- This can be checked in the GUI by navigating to System -> FortiGuard.
- In the CLI, the command 'get system fortiguard-service status' can be used to show expiration dates for various FortiGuard services.
- In the following examples, the expiration date is showing as 2026-03-13:
- In the CLI, a similar expiration date is shown for services covered under the AMP license, such as updates for the AV Engine and Virus Definitions (note the 23:59:59 at the end):
FortiGate # get system fortiguard-service status
NAME VERSION LAST UPDATE METHOD EXPIRE
AV Engine 7.035 signed 2024-08-08 08:37:57 scheduled 2026-03-13 23:59:59
Virus Definitions 93.3081 signed 2025-05-12 08:34:25 scheduled 2026-03-13 23:59:59
Extended set 93.3081 signed 2025-05-12 08:34:25 scheduled 2026-03-13 23:59:59
[...]
When checking from the FortiGate debug output (diagnose debug application update -1), the date returned when querying FortiGuard will show the actual contract expiry date plus two days (T+2):
- In the below snippet of debug output, the contract expiry date for the AVDB is showing as 'Mar 14 17:00:00 2026' (aka 2026-03-14):
FortiGate # diagnose debug application update -1
Debug messages will be on for 30 minutes.
FortiGate # diagnose debug console timestamp enable
FortiGate # diagnose debug enable
FortiGate # exec update-now
2025-05-12 10:37:09 upd_daemon[1838]-Received update request from pid=30479
2025-05-12 10:37:30 upd_daemon[1658]-Found cached action=00000002
2025-05-12 10:37:30 do_update[680]-Starting now UPDATE (final try)
[...]
2025-05-12 10:37:53 update_status_obj[761]-AVDB contract expiry=Sat Mar 14 17:00:00 2026
level(6) alert(0)
[...]
To summarize the behavior:
- The Fortinet Support site date shows the official date at which the license will expire (in the example, it was 2026-03-12).
- On the FortiGate, a grace period of two days has been added to the official date (in this case, the date was set to 23:59:59 on 2026-03-13).
- This grace period gives administrators a chance to disable/adjust services on the FortiGate in case they miss the license renewal date (i.e. to avoid disruption/outages while the licensing situation is being addressed).
- FortiGuard further increases this grace period by another day (three days total, in this case 2026-03-14 at 17:00:00).
- This grace period is for devices that renewed their licenses at the last minute. Without it, there could be a brief period of time where the old license is expired and the new license has not yet synchronized across the FDN (Fortinet Distribution Network), resulting in network disruption whenever the FortiGate attempts to access FortiGuard (such as with Web Filter Category lookups).
Related documents:
