Troubleshooting Tip: Import FortiToken license, 'Internal server error', error: -7650

[kiri]

Description	This article describes how to troubleshoot error -7650 (in CLI) or Internal server error (in GUI) seen when activating a new FortiToken Mobile.
Scope	FortiGate 6.x.
Solution	If importing the license is done from GUI, the error 'Internal server error' will appear. Import it over CLI and run some debug: diagnose debug console timestamp enable diagnose debug application forticldd -1 diagnose debug application alert -1 diagnose fortitoken debug enable diagnose debug enable execute fortitoken-mobile import <ActivationCodeFromRedemptionCertificate> If the output is something like: 2022-05-17 13:41:54 ftm_cfg_import_license[321]:import license abcd-efgh-1234-5678-9101 2022-05-17 13:41:55 ftm_fc_comm_connect[55]:ftm TCPS connected.2022-05-17 13:41:55 ftm_fc_comm_send_request[117]:send packet success. POST /SoftToken/Provisioning.asmx/Process HTTP/1.1 Accept: application/json, text/javascript, */*, q=0.01 Content-Type: application/json;charset=utf-8 X-Requested-With: XMLHttpRequest Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Host: 208.91.113.53:443 Content-Length: 246 Connection: Keep-Alive Cache-Control: no-cache { "d": { "__type": "SoftToken.ActivationLicenseRequest", "__version": "4", "license_activation_code": "abcd-efgh-1234-5678-9101", "serial_number": "FGT60XTK00000000", "__device_version": "7.0", "__device_build": "0304", "__clustered_sns": [ ] } } 2022-05-17 13:42:01 ftm_fc_comm_recv_response[266]:receive packet success. {"d":{"__type":"SoftToken.ActivationLicenseResponse","__version":"4","serial_number":"FGT60XTK00000000","__device_version":"7.0","__device_build":"0304","__clustered_sns":[],"license_activation_code":"abcd-efgh-1234-5678-9101","license":"","tokens":null,"result":0,"error":{"error_code":100,"error_message":"forticare service unavailable"}}} 2022-05-17 13:42:01 ftm_fc_command[615]:received error from forticare [-7650] import fortitoken license error: -7650 'Forticare service unavailable' suggests that the firewall could not reach the FortiGuard network or the FortiGuard network was temporarily unavailable. Check if the firewall can reach globalftm.fortinet.net on port 443: execute telnet globalftm.fortinet.net 443 It is  also possible to run a packet capture when importing the license, using the IP address resolved at 1): diagnose sniffer packet any "host 208.91.113.53 and port 443" 4 0 a If 1 and 2 show successful communication, try to disable the anycast mode on FortiGuard settings then try to import the tokens again. If it still does not help, raise a case with the Technical Support Team with all the outputs and checks done. Related article: Technical Tip: FortiToken basic troubleshooting