Reassigning/Transferrig FortiGate-VM Licenses Between Two HA Clusters (Cluster-A HA & Cluster-B HA)

[Raj_Pandey]

Environment

We have two separate FortiGate-VM HA clusters:
Cluster-A (VM-A-HA): 2 nodes (active–passive)
Cluster-B (VM-B-HA): 2 nodes (active–passive)
Both clusters run FortiGate-VM BYOL licenses (one license per VM node).

Background / What Happened

The licenses on both nodes of Cluster-B expired.
To maintain service availability, we performed a temporary workaround:
Powered off both nodes of Cluster-A.
Downloaded the valid license files for both nodes of Cluster-A from the FortiCare portal.
Uploaded these two licenses respectively to the two nodes of Cluster-B.
Cluster-B resumed normal operation with those temporarily reassigned licenses.
Cluster-A has remained powered off since the license transfer.

Current Situation
We have now purchased new licenses (one per node) for Cluster-B.

Our intention is to:

Apply the new licenses to both nodes of Cluster-B
Restore the original Cluster-A licenses back to the two nodes in Cluster-A
Bring both clusters back into healthy HA state with proper licensing.

Before doing this, we require suggestion/validation to avoid backend conflicts, duplicate-license errors, HA mismatches, or FortiGuard issues. #fortigate

[esalija]

Hi @Raj_Pandey 

- To ensure a smooth transition and avoid any conflicts or errors, follow these steps:

- Prepare New Licenses for Cluster-B:
Download the new licenses for both nodes of Cluster-B from the FortiCare portal.

- Apply New Licenses to Cluster-B:
Shut down both nodes of Cluster-B to ensure the existing temporary licenses are removed from FortiGuard Servers. Keep them shut down for at least 90 minutes.
Upload the new licenses to both nodes of Cluster-B simultaneously to maintain HA consistency.

- Restore Original Licenses to Cluster-A:
Ensure Cluster-A nodes remain powered off for at least 90 minutes to clear any license data from FortiGuard Servers.
Upload the original licenses back to the nodes of Cluster-A.

- Power On and Verify:
Power on both clusters and verify that each node is operating with the correct license.
Check the HA status to ensure both clusters are in a healthy state.

- Monitor for Errors:
Monitor the system logs for any 'Duplicate license detected' errors or other issues.
Ensure FortiGuard services are functioning correctly on both clusters.
- By following these steps, you should be able to restore both clusters to a healthy state with proper licensing.

Best regards,

Erlin

[Raj_Pandey]

@esalija

Thanks a lot for your response and the clarity. However, I have one more question.
If I upload the newly purchased license directly to Cluster-B, will it override the existing license on Cluster-B and change the serial number? After that, I plan to power on Cluster-A, since Cluster-B would already have the new license I uploaded, and Cluster-A could then retain its old license. This approach should allow us to keep the outage window minimal without disrupting the current traffic flow.

I am asking about this behavior because Cluster-B is in production, and we need to maintain minimal downtime. For Cluster-A, I can wait for 90 minutes. What do you suggest—can I proceed this way?

[esalija]

Hi @Raj_Pandey,

Yes, you can proceed with uploading the newly purchased licenses directly to Cluster-B.

1. Upload the new licenses to both nodes of Cluster-B. This will override the existing temporary licenses and update the serial numbers accordingly.
2. Ensure that both nodes in Cluster-B are synchronized and functioning correctly after the license update.
3. Once Cluster-B is stable with the new licenses, power on Cluster-A.
4. Since Cluster-B now has its own valid licenses, Cluster-A can retain its original licenses without conflict.
5. After powering on Cluster-A, verify that both clusters are operating correctly with the appropriate licenses.
6. Check the HA status and ensure that FortiGuard services are functioning as expected.

Thank you,
Erlin

[Raj_Pandey]

Great!! Thanks I will plan this next weekend. One last thing should I upload the license first in cluster-B, primary firewall first as it will reboot or uploading the license in secondary firewall is recommended first.

[esalija · Accepted solution]

Hi @Raj_Pandey 

- For minimal disruption, upload the new license to the secondary firewall in Cluster-B first.

- This approach allows the secondary unit to reboot and update without affecting the active traffic flow.- 

- Once the secondary unit is updated and stable, proceed to upload the license to the primary firewall.

- This sequence helps maintain service availability during the update process.

Thanks, Erlin