Troubleshooting Tip: FortiToken exists in cloud but cannot be assigned

[rmehta]

Description	This article describes a scenario where a FortiGate fails to locate or validate a FortiToken Mobile or FortiToken Cloud during user assignment. When this occurs, FortiGate displays the error 'No valid token found' or error -7567, preventing the token from being successfully assigned to a local user.
Scope	FortiGate, FortiToken.
Solution	One of the following error messages is displayed in the GUI when assigning a token: 'No valid token found'. Provision token error: -7567. The token cannot be assigned to a user. The FortiToken activation email may not be sent. SSL VPN login fails with 2FA enabled. Debug commands: diagnose debug disable diagnose debug reset diagnose debug console time enable diagnose fortitoken debug enable execute fortitoken-mobile import <ActivationCodeFromRedemptionCertificate> Example debug output: "license_activation_code": "6E2A-0E0C-2A64-1455-1000", {"token":"FTKMOB27C3E7B708"}],"result":2,"error":null}} from this output it shows that FTKMOB2726BA4804 was associated with certificate code 6E2A-0E0C-2A64-1455-1000 FortiToken debugging showed no errors, confirming that the token was correctly licensed and associated. Token FTKMOB2726BA4804 was confirmed as valid and licensed, and was associated with an Activation Code From the Redemption Certificate: 6E2A-0E0C-2A64-1455-1000. Delete and re-add the token via the GUI (Recommended): Delete the Token. Go to User & Authentication -> FortiTokens. Locate the affected token (e.g. FTKMOB2726BA4804). Select the token. Select Delete. Confirm deletion. Re-add the token. Navigate to User & Authentication -> FortiTokens. Select Create New. Select FortiToken Mobile / FortiToken Cloud. Enter the Activation Code from the FortiToken certificate. Complete the import Assign the token to the user. Go to User & Authentication -> Users. Edit the affected user. Enable Two-factor Authentication. Select the re-added token. Choose Email or SMS for activation. Select OK. The activation email should then be sent successfully. The issue can be resolved by deleting the affected FortiToken from the FortiGate and re-adding it to refresh the local FortiToken database. After re-adding the FortiToken: Token provisioning could complete successfully. The activation email could be sent without errors. The FortiToken could be assigned to the user correctly. Two-factor authentication and SSL-VPN access could function as expected.

[rmehta]

Description	This article describes a scenario where a FortiGate fails to locate or validate a FortiToken Mobile or FortiToken Cloud during user assignment. When this occurs, FortiGate displays the error 'No valid token found' or error -7567, preventing the token from being successfully assigned to a local user.
Scope	FortiGate, FortiToken.
Solution	One of the following error messages is displayed in the GUI when assigning a token: 'No valid token found'. Provision token error: -7567. The token cannot be assigned to a user. The FortiToken activation email may not be sent. SSL VPN login fails with 2FA enabled. Debug commands: diagnose debug disable diagnose debug reset diagnose debug console time enable diagnose fortitoken debug enable execute fortitoken-mobile import <ActivationCodeFromRedemptionCertificate> Example debug output: "license_activation_code": "6E2A-0E0C-2A64-1455-1000", {"token":"FTKMOB27C3E7B708"}],"result":2,"error":null}} from this output it shows that FTKMOB2726BA4804 was associated with certificate code 6E2A-0E0C-2A64-1455-1000 FortiToken debugging showed no errors, confirming that the token was correctly licensed and associated. Token FTKMOB2726BA4804 was confirmed as valid and licensed, and was associated with an Activation Code From the Redemption Certificate: 6E2A-0E0C-2A64-1455-1000. Delete and re-add the token via the GUI (Recommended): Delete the Token. Go to User & Authentication -> FortiTokens. Locate the affected token (e.g. FTKMOB2726BA4804). Select the token. Select Delete. Confirm deletion. Re-add the token. Navigate to User & Authentication -> FortiTokens. Select Create New. Select FortiToken Mobile / FortiToken Cloud. Enter the Activation Code from the FortiToken certificate. Complete the import Assign the token to the user. Go to User & Authentication -> Users. Edit the affected user. Enable Two-factor Authentication. Select the re-added token. Choose Email or SMS for activation. Select OK. The activation email should then be sent successfully. The issue can be resolved by deleting the affected FortiToken from the FortiGate and re-adding it to refresh the local FortiToken database. After re-adding the FortiToken: Token provisioning could complete successfully. The activation email could be sent without errors. The FortiToken could be assigned to the user correctly. Two-factor authentication and SSL-VPN access could function as expected.