FortiToken
FortiToken Mobile is an application for iOS or Android that acts like a hardware token but utilizes hardware the majority of users possess, a mobile phone.
jiahoong112
Staff
Staff
Article Id 217292
Description

 

This article describes how to perform a FortiToken Mobile (FTKM) to FortiToken Cloud (FTC) migration and what to check and troubleshoot when errors occur.

In this case: FortiToken Mobile to FortiToken Cloud Migration, Invalid License.

 

Pre-requisites:
- FortiGate FortiOS minimum version must be 7.0.4.
- Ensure FortiCare license is valid, up to date and not expired.
- Ensure the steps in this article are followed: https://docs.fortinet.com/document/fortitoken-cloud/latest/admin-guide/626658/migrate-ftm-tokens-to-...

 

Scope

 

FortiToken Mobile to FortiToken Cloud migration. Invalid License error.

 

Solution

 

1) Ensure there is a FortiToken Mobile license number. This can be found  into the Fortinet Support Portal, support.fortinet.com.

 

2) Under Asset Management, go to Products -> More Views -> License.

It will be possible to find it under the License Number column.

FortiToken Mobile license has an SKU of FTM-ELIC-<number>.

 

This is the license number that will be used in the troubleshooting commands below.
License number usually starts with EFTM followed by 12 numbers.

 

3) Check whether FTC servers are reachable:


# diagnose fortitoken-cloud server <----- This IP should be reachable via ping.


4) To check whether the migration from FortiToken Mobile to FortiToken Cloud will be successful, use these commands:


# diag fortitoken-cloud migrate-ftm show <FTKM license_number>
# diag fortitoken-cloud migrate-ftm start <FTKM license_number>

 

5) If migration is possible, output similar to this will be seen:

 

Firewall A (global) # diag fortitoken-cloud migrate-ftm start <FTKM license number>
Warning: Please acknowledge that request will be sent to fortitoken-cloud to
start license migration where migration eligibility will be checked and a new
FTC license will be created with corresponding user quota to accept user migration.
Ready to proceed? (y/n)

 

- This indicates that the FortiToken Mobile license is valid and migration is possible.

 

Note.

If the FortiToken Mobile license has 100 tokens, FortiToken Mobile to FortiToken Cloud migration will migrate ALL the Tokens.

Partial migration is not possible; example, To only migrate 50 out of the 100 FortiToken Mobile Tokens to FortiToken Cloud, this is not possible.

 

It is possible to proceed with this command to perform the migration:

 

# execute fortitoken-cloud migrate-ftm <FTKM license number>

 

6) However, if an error message similar to this occurs, proceed to Step 7):


Firewall A # diag fortitoken-cloud migrate-ftm start <FTKM license_number>
Invalid license!

Firewall A # diag fortitoken-cloud migrate-ftm show <FTKM license_number>
Result: {"status": "deny"}

 

7) Firstly, ensure all entries in '# show user fortitoken' should have the 'set license' parameter; it should look like this:


Firewall A (root) # show user fortitoken
# config user fortitoken
    edit "FTKMOBbla"
        set license "<hidden for privacy purposes>"
        set activation-code "<hidden for privacy purposes>"
        set activation-expire <hidden for privacy purposes>
        set reg-id "<hidden for privacy purposes>"
        set os-ver "<hidden for privacy purposes>"
    next
        edit "FTKMOBblabla"
            set license "<hidden for privacy purposes>"
            set activation-code "<hidden for privacy purposes>"
            set activation-expire <hidden for privacy purposes>
            set reg-id "<hidden for privacy purposes>"
            set os-ver "<hidden for privacy purposes>"
        next

And NOT like this:


    edit "FTKMOBblabla"
        set os-ver "<hidden for privacy purposes>"
    next
        edit "FTKMOBblabla"
    next
        edit "FTKMOBblabla"
            set reg-id "<hidden for privacy purposes>"
            set os-ver "<hidden for privacy purposes>"
        next

If it looks like the latter, FortiToken Mobilewill have to be re-provisioned.

FortiToken MobileActivation Code is required to do this.


If the FortiToken Mobile activation code is lost, contact Fortinet Customer Support.

 

Additional debug commands for Fortitoken Cloud:


# diag fortitoken-cloud debug enable
# diag debug enable
# diag fortitoken-cloud sync all

 

To disabled debug:


# diag debug disable
# diag debug reset