Fortitoken Mobile Serial Number Associations

[nateblaum]

So I've created a ticket with Fortinet, and I don't think the tech understood what I was asking so I'll try to explain my question here to see if anyone else has this same problem. I've got one Fortigate that was setup for my company's IPSEC VPN tunnel, and we have roughly 170 Fortitoken Mobile licenses that have been input using multiple license packs as we've built up to 170 over time (several packs of 20 licenses, and one pack of 50). 

For the sake of this example, let's say that I have the following. 

Pack 1 - 20

Pack 2 - 20

Pack 3 - 50

Pack 4 - 20

Pack 5 - 20

Pack 6 - 20

Well we've run into a problem with our internet pipe where we have reached the maximum number of sessions allowed on the circuit, and we need to offload some of the users to a different firewall/internet pipe. Easy enough right? 

When I contacted Fortinet, they wanted to know which license file I wanted to transfer, but my question for them was that I wanted to know which token serial numbers were associated with which license file so I could determine which license file I wanted to move. My fear is that I have individual serial numbers already associated with user accounts on ALL of my license packs, but if I could easily identify which serial number was associated with which pack, then I could determine the least disruptive license pack to move. For instance I don't want to say to move pack 2 and find out that there's 16 assigned tokens from that group, and have to reconfigure all of those users when Pack 5 has 2 tokens assigned, or worse yet come to find out that Pack 6 has no tokens assigned. 

Does this make sense to anyone else? Am I just asking the wrong question? Has anyone else run into this problem or know of a way to solve this problem? 

[bchander]

Hi Nateblaum,

Were you able to figure out your issue with fortitoken serial numbers and their batches. I am currently in the same situation.

[kgladwin]

I am also curious and in the very same situation, I only need to move 1 of many EFTM licenses and want to know which tokens were generated by the one I'm going to move to ensure it is freed up beforehand.

[Toshi_Esumi]

It's easy. Each token configuration in CLI has its license number, which it was populated from during the license activation (token S/N population) process, like below:

config user fortitoken
  edit "FTKMOBxxxxxxxxxx"
    set license "EFTMxxxxxxxxxxxx"
    set activation-code "xxxxxxxxxxxxxxx"
    set activation-expire xxxxxxxxxxxx
    set reg-id "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    set os-ver "5.4.2_IOS"
  next
  ..........
end

Toshi