FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
mattchow_FTNT
Article Id 362194
Description This article describes how to solve the missing contract when getting update from FortiManager.
Scope FortiGate.
Solution

In some of the user's closed environments or with no internet access to get an update from FortiGuard, it is required to get an update from FortiManager.

 

The connection between FortiGate and FortiManager can be troubleshoot using update debug, and missing contracts can be observed  as shown in the example below:

 

upd_status_set_ha_expiry[1511]-Serial Number: FGXXX- contract processed
upd_status_set_ha_expiry[1526]-Missing contracts, got 1, expect 2 <-----
upd_status_set_ha_expiry[1544]-Reset expiry
__update_upd_comp_by_settings[494]-Disabling NIDSDB/ISDB/MUDB components.
__update_upd_comp_by_settings[498]-Disabling APPDB/IOTDB components.

do_update[678]-UPDATE failed

 

The issue is caused by FortiManager only update 1 contract out of 2, it is required to request account entitlement or contract and upload to FortiManager:

Requesting account entitlement files
Uploading account entitlement files


A Fortinet Customer Service ticket can be created for contract and license issues such as HA cluster members are not registered to one account and a FortiManager ticket is required if the upload failed.