License expiry and renewal

FortiPAM must have a valid license to provide all the services. Therefore, you must keep track of the license status.

By default, FortiPAM sends license expiration notification 30 days before a license expires.

The license expiry notification timing can be adjusted by using the following CLI command:

config alertemail setting

set FDS-license-expiring-days 30 #adjust the number of days

end

To renew a license, contact the FortiPAM sales team. After purchasing FortiPAM services, you receive the service registration document that includes the service name in the title and a contract registration code.

Follow the procedure as detailed in Renewing FortiPAM-VM license to renew FortiPAM-VM license.

License status

FortiPAM license status can be found in the Licenses widget available in Dashboard > Status. See Licenses widget.

Email alert for license expiration

License expiration email notification is one of the critical system notifications.

When a FortiPAM license is about to expire, i.e., the license is expiring within the next 30 days; a warning dialog appears when you log in to FortiPAM. Also, a red banner appears on the top once you are logged in, alerting you about license expiry.

To set up email alerts for license expiry:

1. Ensure that Email Service is set up in System > Settings. See Settings.
2. Go to Log & Report > Email Alert Settings, and select Enable email notification.
3. In the Critical System Notification tab:
   1. In From, enter the email address of the sender.
   2. In To, enter the email address of the receiver.
4. Click Apply.

   Alternatively, you can add an email address where the notification is sent when creating or editing a user in User Management > User List (Configure User Details tab).

   For expiring Advanced Malware Protection and FortiCare support, license expiration email notifications and warnings are sent to the administrator.

CLI configuration for setting up email alerts for license expiry example:

config system automation-action

edit "License Expired Notification Email"

set action-type email

set email-subject "FortiPAM %%log.devname%% %%log.logdesc%%"

set email-to "admin1@fortinet.com" "admin2@fortinet.com" # receiver email address

set message "Your license is expiring soon. Please renew at your earliest convenience. If your FortiPAM Subscription license is expired, only super admin will be allowed to access FortiPAM until a new license is applied.

Detail:

%%log%%"

set description "Default automation action configuration for sending an email when a license is near expiration."

next

end

Subscription license

FortiPAM-VM is licensed by annual subscription. The FortiPAM-VM subscription license controls the licensed user seats. Once the license expires:

1. Only a user with Super Administrator role can log in to the FortiPAM GUI.
2. FortiPAM goes into maintenance mode.

   In the maintenance mode:

   1. All secrets/folders are read-only.
   2. Critical processes are suspended including manual and scheduled password changing.
3. You cannot launch secrets.

   A Super Administrator can enable the glass breaking mode to see all the secrets.

   Although not recommended, a Super Administrator can promote normal users to the Super Administrator role, allowing users to continue logging in to FortiPAM.

   Users with permission, such as the Default Administrator role, can still access FortiPAM through ssh and the CLI console.

Advanced Malware Protection (formerly AntiVirus and DLP license)

The FortiPAM-VM subscription license includes Advanced Malware Protection and FortiCare support. For FortiPAM hardware models, Advanced Malware Protection and FortiCare support licenses are purchased separately as annual contracts.

The Advanced Malware Protection (AVDB & DLP) licenses are related to the file scanning feature in file launchers. Once the Advanced Malware Protection license expires:

1. The antivirus scanning continues to work, however the antivirus database is not updated and no new signatures are added.
2. DLP feature stops working. The DLP feature requires a valid license.