Troubleshooting Tip: Troubleshoot licensing issue in FortiSOAR

[jankit6]

Description	This article helps to troubleshoot the license-related issues in FortiSOAR GUI login.
Scope	All supported versions of FortiSOAR.
Solution	The most common error on the GUI login with the licensing is 'FSR-Auth-003: License Entitlement Sync failed. Ensure that https://globalupdate.fortinet.net is accessible from your environment. If the issue still persists, contact support.' It could be due to multiple reasons: Make sure the FortiSOAR license server is reachable from the FortiSOAR box: curl -v -k https://globalupdate.fortinet.net Disable SSL inspection at Proxy for https://globalupdate.fortinet.net. It is important to note that FortiSOAR does server certificate verification when connecting to the update server; this can fail when SSL inspection is enabled at proxy, since the server certificate will be changed. To verify what certificate is presented during SSL negotiation: openssl s_client -connect globalupdate.fortinet.net:443 -showcerts In case disabling SSL inspection is not possible, it is possible to import the correct CA issues for the proxy inspection. Refer to: Licensing FortiSOAR The following command can also be used to test the connectivity with the licensing server. java -jar /opt/cyops-auth/bin/fdnclient.jar <serial_no> <device_uuid> https://globalupdate.fortinet.net If the global update is reachable via Proxy only, then export the below variables before running the above command to test the connectivity: export url=<proxy ip/fqdn> export port=<proxy port> export username=<proxy user> export password=<password> In the case of the Docker environment:  URL, port, username, and password must be set in 'docker-compose YAML environment' and '/etc/environment'. "docker environment" url=<proxy ip/fqdn> port=<...> And: "/etc/environment" export url=<proxy ip/fqdn> export port=<proxy port> export username=<proxy user> export password=<password> Note: Nginx listens 443 SSL must not be changed due to internal API calls. In case there is a firewall policy or IP filtering for the outbound traffic, the policy should allow the source address of FortiSOAR to the destination FQDN of globalupdate.fortinet.net For more details, review the logs below: /var/log/cyops/cyops-auth/das.log