VM license

You can access FortiGate VM License from Dashboard > Status in the Virtual Machine widget. Click the device license and select FortiGate VM License.

FortiGate VM License displays the following information:

This information is visible in the CLI by running get system status. See CLI troubleshooting.

Uploading a license file

After you submit an order for a FortiGate-VM, Fortinet sends a license registration code to the email address that you entered in the order form. Use this code on the FortiCloud portal to register the FortiGate-VM.

Once the VM is registered, you can download the license file in .LIC format. On the FortiGate VM License page, click Upload. The system prompts you to reboot and validate the license with the FortiGuard server. Once validated, your FortiGate-VM is fully functional.

The VM license window may also appear immediately after logging in if you are running a VM with an evaluation license that has expired.

In cases where the GUI is inaccessible, you can upload the license using secure copy (SCP).

For information about injecting FortiFlex licenses, see Injecting the FortiFlex license.

To upload the license using SCP:

1. Enable SCP:

   config system global
       set admin-scp enable
   end

2. Enable SSH in the administrative access for the interface where the transfer will take place:

   config system interface
       edit <interface>
           append allowaccess ssh
       next
   end

3. On your computer, upload the VM license. This example is for Linux:

   scp <filename> <admin-user>@<FortiGate_IP>:vmlicense

License activation and validation

Once the license file is uploaded using the GUI or SCP, the FortiGate-VM initiates a validation process with the FortiGuard servers. For successful activation, the following requirements must be met:

• Connectivity: The FortiGate-VM must have a valid route to the internet.

• Upstream Firewall Rules: If the FortiGate-VM is behind another firewall, ensure that traffic is allowed to the following Fully Qualified Domain Names (FQDNs):

Monitoring the activation process

You can monitor the license registration and communication with FortiGuard in real-time using the CLI. This is particularly useful for troubleshooting connectivity issues during initial setup.

To enable the debug output for the VM license validation process:

# diagnose debug application cloudinitd -1
# diagnose debug enable

Validation with anycast enabled

When anycast is enabled (default), the FortiGate attempts to resolve and connect to the anycast update servers.

# diagnose debug application cloudinitd -1
# diagnose debug enable 

vmlic status:success, valid:1
vmlic load config
vmlic setup vfid:0
vmlic resolve:vmactivation1.fortinet.net
vmlic server:192.168.100.85
vmlic add 192.168.100.85
vmlic setup 192.168.100.85
[222] ssl_add_ftgd_hostname_check: Add hostname checking 'vmactivation1.fortinet.net'
...
Protocol=3.0|Command=VMSetup|Firmware=FGVM64-FW-7.4.x|SerialNumber=FGVMSLTMxxxxxxxx
vmlic setup result:200

After the process completes, verify the final license status using the get system status command. See CLI troubleshooting for more information.

Validation with anycast disabled

If anycast is disabled, the FortiGate attempts to resolve and connect to the non-anycast update servers.

# diagnose debug application cloudinitd -1
# diagnose debug enable 

vmlic status:success, valid:1
vmlic setup vfid:0
vmlic resolve:update.fortiguard.net
vmlic server:192.168.100.205
vmlic add 192.168.100.205
[219] ssl_add_ftgd_hostname_check: Add hostname checking 'update.fortiguard.net'
...
vmlic setup result:200

After the process completes, verify the final license status using the get system status command. See CLI troubleshooting for more information.

VM license types

FortiGate-VM annual subscription licensing (S-series). SKUs are based on the number of vCPUs (1, 2, 4, 8, 16, 32, or unlimited).

FortiGate-VM has a permanent trial license. See Permanent trial mode for FortiGate-VM.

The FortiFlex program allows qualified enterprise and MSSP customers to create as many VM entitlements as required. Resource consumption is based upon predefined points that are calculated on a daily basis. See Program guide.

¹ FortiGate-VMs with one VDOM license (S-series, FortiFlex) have a maximum of two VDOMs: an administrative type root VDOM and a traffic type VDOM. To add a second VDOM, first change the root VDOM to administrative type and then add the traffic VDOM.

Applying a FortiFlex token

You can apply a FortiFlex token in the FortiGate VM License page for the following VM instance types:

• Newly deployed or expired FortiGate-VM instances. After logging into the FortiOS GUI, a FortiFlex token option is available when the license popup appears.

• Already licensed FortiGate-VM instances. You can go to this page from the Virtual Machine dashboard widget or from System > FortiGuard. FortiFlex token option is available for migrating into FortiFlex.

Consuming a new vCPU

FortiGate-VM supports automatic vCPU hot-add/hot-remove to the limit of the license entitlement after activating an S-series license or a FortiFlex license. This enhancement removes the requirement of running the CLI command execute cpu add or performing a reboot when the FortiGate-VM has a lower number of vCPUs allocated than the licensed number of vCPUs.

CLI troubleshooting

In some cases, you can view more information from the CLI to diagnose issues with VM licensing. This is also useful when the GUI is inaccessible due to an invalid contract.

Before you begin, ensure your FortiGate has the proper routes to connect to the internet. Run all following debug commands for a full picture of the issue.

To view the license status, expiration date, and VM resources:

# get system status
Version: FortiGate-VM64-KVM v7.4.10,buildXXXX,200730 (GA)
...
Serial-Number: FGVM08**********
....
License Status: Valid
License Expiration Date: 2026-12-10
VM Resources: 1 CPU/8 allowed, 2010 MB RAM
...

To display license details:

# diagnose debug vm-print-license
SerialNumber: FGVM08**********
CreateDate: Tue Dec 10 00:57:32 2019
License expires: Thu Dec 10 00:00:00 2026
Expiry: 366
Key: yes
Cert: yes
Key2: yes
Cert2: yes
Model: 08 (11)
CPU: 8
MEM: 2147483647

To display license information from FortiGuard:

# diagnose hardware sysinfo vm full
UUID:     abbe****************************
valid:    1
status:   1
code:     200
warn:     0
copy:     0
received: 4604955037
warning:  4600905081
recv:     202009152207
dup:

The following are examples of common combinations:

valid:    1
status:   1
code:     200

valid:    1
status:   4
code:     401

valid:    0
status:   2
code:     502

valid:    0
status:   3
code:     400

valid:    0
status:   3
code:     0

For FortiFlex licenses, the following command allows you to enter the license token and proxy information:

# execute vm-license <token> https://<username>:<password>@<proxy IP address>:<proxy port>

FortiOS can receive the following error codes from the FortiCare server:

1 - Runtime error (server unhandled error on FortiCare sever)
57 - License Token is invalid
58 - License Token is already used and cannot be used again to retrieve license key

The FortiGate can generate the following error code:

60 - Failed to request forticare license. Failed to download VM license.

Contact Fortinet Support for assistance if your licensing issue persists.

Customizing the FortiFlex license token activation retry parameters

FortiOS supports the customization of the retries for FortiFlex license token activation. The token activation number of retries and the interval between each attempt can be configured using the following commands, respectively:

execute vm-license-options count <integer>
execute vm-license-options interval <interval length in seconds>

If the vm-license-options count is set to zero, the token activation will retry indefinitely until success.

To define the FortiFlex token activation parameters:

1. Set the number of retries allowed:

   execute vm-license-options count 4

2. Set the retry interval:

   execute vm-license-options interval 5

3. Activate the license. FortiOS requests the FortiFlex license token four times, with an interval of five seconds in between, as set.

   • If FortiOS cannot verify the license within the set amount of retries, the download fails:

     # execute vm-license F4FC697D65428013FAKE
     This operation will reboot the system !
     Do you want to continue? (y/n)y
     
     Requesting FortiCare license token: *******, proxy:(null)
     Requesting FortiCare license token: *******, proxy:(null)
     Requesting FortiCare license token: *******, proxy:(null)
     Requesting FortiCare license token: *******, proxy:(null)
     Failed to download VM license.

   • If FortiOS can verify the license within the set number of retries, FortiOS successfully installs the VM license:

     # execute vm-license 227602862F7E6E9XXXX
     This operation will reboot the system !
     Do you want to continue? (y/n)y
     
     Requesting FortiCare license token: *******, proxy:(null)
     VM license install succeeded. Rebooting firewall.

FortiFlex token activation parameters can also be defined in an ISO file using the mime user-data.

To define the parameters in an ISO file:

1. Create a config drive ISO with a MIME file:

   Content-Type: text/plain; charset="us-ascii" 
   MIME-Version: 1.0 
   Content-Transfer-Encoding: 7bit 
   Content-Disposition: attachment; filename="license.txt
   "LICENSE-TOKEN: 334ADF7B49F2FEC1XXXX INTERVAL: 5 COUNT: 4

   See Cloud-init using config drive for more information.

2. Attach the ISO config drive at boot time. See Cloud-init for more information.

3. Boot up the VM and verify the token activation parameters:

   # diagnose debug cloudinit show
    >> Found config drive /dev/sr0
    >> Successfully mount config drive
    >> MIME parsed preconfig script
    >> MIME parsed VM token
    >> MIME parsed config script
    >> Found metadata source: config drive
    >> Run preconfig script
    >> FortiGate-VM64  conf sys global
    …
    >> Trying to install vmlicense ...
    >> License-token:334ADF7B49F2FEC1XXXX INTERVAL:5 COUNT:4
    >> Run config script