Fortigate 200G active/passive licence

[ProtocolSA]

Hello,

I would like to install a Fortigate 200G with active/passive HA.

That's mean that only one Firewall is running, the second, just in case of problem on the primary.

Our reseller said that's it's required to have both licences and maintenance same on both firewalls.

Is that's correct ?

Thank you.

[plsikk]

Yes because HA is only setup , but contract is for Hardware 

[ProtocolSA]

Hello,

Ok I understand that I need a hardware support, it's normal, and we need to get it, but....

If we choose the Bundle with Enterprise Protection we get:

• FortiCare 24x7
• FortiGuard App Control Service
• FortiGuard IPS Service
• FortiGuard Advanced Malware Protection
• FortiGuard Web Filtering Service
• FortiGuard Antispam Service
• FortiGuard Security Rating Service
• FortiGuard Industrial Service
• FortiCASB SaaS-only Service

But in a active / passive case, we do not use Web Filtering 2 times, Antispam 2 times, Antivirus 2 times and 2 times all others services. We use it only on the (one) running appliance (1), not on both, so it's not very cool from Fortinet to force customer to buy licence not used. Imagine that in 5 years we don't have any problem with the running appliance, so the licence of the (inused) second one are just only for giving money to Fortinet.

A HW support licence for the second HA in Active / Passive mode would be the solution, but I think with the mode of licencing every appliance in the HA (however in passive mode) we jump into very expansive price if I compare to other brand that make this difference (active/active & active/passive).

At this time, if there is no solution other to get 2 FULL licences at the same price for an HA active/active or active/passive mode, I think we will see outside Fortinet.

[plsikk]

license is linked with serial number - so what is you passive FGT will be promoted as active - so no license ? I remember Cisco had HA license for WLC just for failover and HA can't be active longer then some time. But for Forti no. We have more then 200 FGTs and for all units license have to by active

[dingjerry_FTNT]

Hi @ProtocolSA ,

You need to get valid licenses for both devices in the same HA cluster.  Otherwise, in the FGT GUI, it will show no valid licenses even if you do have them for the primary only.

[plsikk]

This is what I said. He need license and contract for both.

[owen911 · Accepted solution]

Based on Administration Guide v7.6.1, v7.4.6, V7.2.9

A-P setup is able to share single license with a certain range of variants. 
refer to below guide 

https://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/246857

https://docs.fortinet.com/document/fortigate/7.4.0/new-features/246857/single-fortiguard-license-for...

[plsikk]

OK this is something new. Cool Will check with our KAM. Thanks for sharing

[ProtocolSA]

Ok shared licences is only for some "small" appliance. Everything's seems clear.

Thank you to all contributors for this particularity of licenses mode for the Active / Passive mode.

[plsikk]

question because in documentation I found this 

Do not change the HA mode from A-P to A-A when set logical-sn enable. This will result in the FortiGate losing its vSN. Disabling logical-sn will also result in losing the vSN. As a result, service entitlements will no longer be registered to the HA cluster.

What happen if one unit failed and have to be replaced via warranty. New device have new SN and vSN probably will be new. How to transfer license if it's possible ?