When creating new VMs on Promox 8.x or higer , the VM license validation fails for FortiOS VMS (Fort

[dennisv]

When creating new VMs on Promox 8.x or higer , the VM license validation fails for FortiOS VMS (FortiGate/FortiAnalyzer/FortiManager etc).

Reference https://community.fortinet.com/t5/FortiGate/Technical-Tip-VM-shows-License-status-Invalid-Copy/ta-p/...

Time of writing June 2024 using Proxmox 8.2.2

This can be validated by showing the current UUID inside the FortiOS VM.

(FortiGate VM used in examples)

# diagnose hardware sysinfo vm full

UUID: 00000000000000000000000000000000

The UUID will either show all 0's or conflict with an existing running instance.

This UUID can be altered in Promox, but the VM needs to be shut down to alter these settings.

GUI : The UUID of the VM can be found when opening the VM settings > Options page > SMBIOS settings (type 1).

CLI : Use qm config <VMID> | grep uuid. Replace <VMID> with the ID of the VM.

It should have a UUID in the form of a large number and letter sequence.

If the UUID in Promox is missing create a new UUID. This is rare as this value is automatically created on a new instance.

The UUID needs to be unique for every FortiOS VM in existence when contacting the licensing service.

It needs to be in hexadecimal notation (0-9,a-f), thus the UUID in the example is invalid to prevent it from being used.

This UUID will show in FortiOS when using the # diagnose hardware sysinfo vm full command.

Note that the - are shown in Promox, but the UUID in FortiOS will remove these and show all 32 characters as single string.

Example Promox is uuid=12345678-xxxx-1234-xxxx-1234abcd1234

Example FortiOS will be UUID: 12345678xxxx1234xxxx1234abcd1234

If there is a UUID in Proxmox but does not match the UUID from the command in FortiOS, it's most likely parsed incorrectly.

In most cases the UUID in FortiGate will show all 0's indication it can't read the value set in Proxmox.

Proxmox 8.x and higher creates new VMs based on QEMU 8.1+ with SMBIOS 3.0 as default.

SMBIOS 3.0 uses a 64-bit mechanism for the UUID, while SMBIOS 2.8 uses a 32-bit mechanism.

FortiOS (up to 7.4.x) uses the 32-bit mechanism to read the UUID from the SMBIOS.

If the SMBIOS is on version 3.0 and not adjusted,this breaks the query of the UUID set in the SMBIOS.

It causes FortiOS to show UUID 000000000000000000 (or an incorrect UUID), which results in an invalid / duplicate license detection.

External References :

https://gitlab.com/qemu-project/qemu/-/commit/bf376f3020dfd7bcb2c4158b4ffa85c04d44f56d

https://forum.proxmox.com/threads/uuid-lost-after-changing-machine-type.136942/

This can be fixed in two different ways by the user after validating a UUID is set in Proxmox.

1) Change the bios version to 7.2 to force SMBIOS to use the 32 bit value.

This lowers the QEMU BIOS and might have impact on (future) features.

It's recommended to use the other option, but will require the usage of CLI and thus local login priviliges.

In GUI :

Open the VM Hardware page.

Edit the "Machine" setting stating i440fx or q35.

Select the Advanced button to show the various hardware versions.

Change the version from latest to 7.2 and press OK.

In Proxmox CLI:

Local login priviliges to the CLI of the Promox instance is required.

From the Proxmox CLI this can be done using the qm set <VMID> --machine=<TYPE>.

Replace <VMID> with the ID of the VM and replace <TYPE> with either pc-q35-7.2 or pc-i440fx-7.2.

The string does not have to be in brackets or quotes.

Example : qm set 12345 --machine=pc-q35-7.2

2) Keep the bios version, but inform the VM to use the 32-bit flag in SMBIOS.

This keeps the QEMU BIOS on the latest version.

This step can't be performed on the GUI (current 8.2.2 at time of writing)

Local login priviliges to the CLI of the Promox instance is required.

In Proxmox CLI:

From the Proxmox CLI this can be set using the qm set <VMID> --args="-machine smbios-entry-point-type=32".

Using the command will overwrite any existing value present.

It's advised to check for an existing value.

Use qm config <VMID> | grep args to check if there is any value present.

Copy any existing value and create a new value with -machine smbios-entry-point-type=32 at the end.

It's advised the keep the entire value string between quotes (")

Replace <VMID> with the ID of the VM.

Example : qm set 12345 --args="-machine smbios-entry-point-type=32"

The VM can now be started.

Validate the UUID with

# diagnose hardware sysinfo vm full

This should show the same value in Proxmox as in FortiOS minus the - set in Proxmox.

The license should now be able to validate and the VM will reboot after succesful license retrieval.

[AEK]

Thanks for sharing, Dennisv.