What happens if one Fortigate device expires license on an HA pair

[kgcppublic]

Newbie question here, I'm working in an MSP, and one of our clients Fortigate FW license expired which caused web browsing to be blocked. I've look into this and was able to get things working before we renewed the license.

Our team is planning to give recommendations on purchasing a similar fortigate appliance with identical license but with different expiry dates. I just want to be sure if this will work, if the primary FW loses its subscription will the 2nd device take over if the subscription on it are still active?

[johnathan · Accepted solution]

Each device in the HA cluster needs to be licensed in order for the features to work. The cluster will always take the lowest expiry date on any device. See this article for details: https://community.fortinet.com/t5/FortiGate/Technical-Tip-The-HA-Cluster-requirements/ta-p/325375

[johnathan · Accepted solution]

Each device in the HA cluster needs to be licensed in order for the features to work. The cluster will always take the lowest expiry date on any device. See this article for details: https://community.fortinet.com/t5/FortiGate/Technical-Tip-The-HA-Cluster-requirements/ta-p/325375

[dingjerry_FTNT · Accepted solution]

Hi @kgcppublic ,

If one of the HA cluster members expires the licenses, the whole HA cluster will show the expired information for the licensing.

[ELCaminooo]

What will happen on the inspection capabilities of the HA Cluster if one of the members license expires? Aside from showing the expired license in the GUI since once of the members still have valid UTP license

[dingjerry_FTNT]

As long as the FGT GUI is showing expired licenses (even if one of the cluster members has valid licenses), it will be treated as having expired licenses for the whole HA cluster.

[ELCaminooo]

The only work around for the member with an active license to work is to remove from the cluster and set it up as standalone?

[dingjerry_FTNT]

There is an option to use a single HA cluster license for both members.

Please check this article:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-The-HA-Cluster-license-requirements/ta-p/3...

[ELCaminooo]

How about for those models that are not FG100F and below? Given that one Cluster Member has expired license (UTP). The workaround is to breakdown the FGCP HA and let the FortiGate device with existing license act as standalone?

[dingjerry_FTNT]

Then what you can do:

1) Order and apply valid support licenses to the device with expired licenses.

Or

2) Remove the unit with expired licenses. 

You can still keep the unit with valid licenses as an HA member.