Technical Tip: How to change the IP Address of the FortiManager/FortiAnalyzer VM License file

spathak · ‎08-11-2022

Description

This article describes how to change the IP Address in Asset Management and re-apply the corrected FortiManager/FortiAnalyzer license file.

In some scenarios, the FortiManager/FortiAnalyzer VM may need to be migrated to a new network and assigned new IP address.

When the IP address is changed, the previous license file can no longer be validated. This would disable the GUI and some CLI features until the correct license file is uploaded.

This IP may be configured on any of the VM port and may also not be a routed and reachable one.

Scope

FortiManager/FortiAnalyzer.

Solution

Change the IP under FortiCloud Asset Management (Support Portal).

Under https://support.fortinet.com/, log in with the FortiCloud credentials.
Go to Asset Management -> My Assets, select the device, in the 'Product information' widget, select the 'pen' icon, and update the new IP Address (this IP does not need to be a routed one and or active one, only must be configured on any interface of the FortiManager/FortiAnalyzer).

Back in the 'Product information' widget, download the new license file from the 'License File Download' hyperlink.

Keep that new '.lic' file where it can be easily accessed.

Change the IP for the management interface:

Go to System Settings -> Network -> Interface -> Edit.

After updating it, select 'OK' to save the changes:

Note.

FortiManager will reboot automatically at this point since the new IP invalidates the old license file.

When FortiManager/FortiAnalyzer boots up, log in to GUI with system-level admin (i.e. 'Super_User' profile).

Upload the new license file when prompted:

Note:

FortiManager will reboot automatically at this point since the new license file matches the new IP.

Reclaim the FortiGate to FortiManager tunnels.

If FortiManager cannot initiate the tunnels to the managed FortiGates from its new IP, the below command should be run in the FortiManager CLI:

exe fgfm reclaim-dev-tunnel

If the FortiGate to FortiManager tunnels become up after running the above command, the new FortiManager IP will be automatically updated on all managed FortiGates.

If some FortiGates are behind NAT and cannot be reached from FortiManager, then use the following FortiGate CLI to update the new FortiManager IP address:

config system central-management
set type fortimanager
set fmg xxx.xxx.xxx.xxx <- IP address of the FortiManager.
end

Troubleshooting:

In case of license issues or errors, run the following command and attach it when creating a support ticket.

diag debug vminfo

For FortiGate-FortiManager connectivity issues, collect the following debugs:

Debug on FortiGate:

diag debug reset

diag debug application fgfm 255

diag debug en

Debug on FortiManager:

diag debug reset

diag debug application fgfm 255 <IP>

diag debug en

To restart the connection from the FortiGate CLI by restarting the 'FGFM' daemon.

fnsysctl killall fgfmd

Related articles for connectivity troubleshooting: