All the FortiGates in a cluster must have the same level of licensing. This includes FortiGuard, FortiCloud, FortiClient, VDOMs (if applicable), and FortiOS Carrier (if applicable).
If one of the FortiGates has a lower level of licensing, then all the FortiGates in the cluster operate at the lowest licensing level. For example, if you only purchase FortiGuard Web Filtering for one of the FortiGates in a cluster, when the cluster is established, none of the cluster units supports FortiGuard Web Filtering.
An exception is FortiToken licensing. FortiToken activations are completed in one FortiGate unit and synchronized with all of the FortiGates in the cluster.