Plus what you actually get with FortiCare Essential, Premium and Elite

No fluff. Just the config that works.

Executive Summary

Every Fortinet support ticket runs on three labels and one contract. The Status tells you whose court the ball is in. The Priority (P1 to P4) decides how fast Fortinet TAC has to call you back and how often it has to update you. The FortiCare tier on the serial number (Essential, Premium or Elite) sets the actual clock. Get any of them wrong and a production outage sits in a P3 web queue until the next business day.

Objective: open a Fortinet support ticket the right way, read every ticket status, set and change priority correctly, understand where “severity” fits, and know the exact SLA your contract buys you.

Target audience: network and security engineers, NOC and MSP staff, and anyone who owns Fortinet gear and has ever stared at a ticket stuck in PendCustFB wondering what it means.

Prerequisites and Architecture

Assumed knowledge: basic Fortinet administration and access to the CLI or GUI of the affected device.

Before you can open a technical ticket, all of these must be true:

• You have a FortiCloud / Support Portal account at support.fortinet.com.
• The product is registered to that same account (or you are listed as an authorized user on the account that owns it).
• The serial number has an active FortiCare entitlement. Expired support means no technical ticket.
• You are asking about one issue. Fortinet allows one technical issue per ticket.
• It is a support issue, not a missing feature. Missing features are New Feature Requests (NFR) and are not handled as support tickets.

Step-by-Step: How to Open a Fortinet Support Ticket

Step 1: Confirm the entitlement

Goal: make sure the serial number is covered, and know which tier it has, before you need it.

Action: in the Support Portal go to Product List, select the serial number, then open Entitlement. Note the support level and expiry. On the device itself, grab the serial and firmware so they go straight into the ticket.

# FortiGate CLI: serial number, firmware build, HA mode
get system status

# Tip: the serial number is what the Support Portal asks for first

GUI verification: System > FortiGuard shows the FortiCare Support line with the contract level and expiry date. If it says expired or unregistered, fix that first (Customer Service ticket), not a technical ticket.

Step 2: Gather the evidence before you click Create

Goal: give TAC everything in the first submission. Missing data is the number one reason tickets bounce to PendCustFB.

Action: collect the following, and attach it to the ticket. Fortinet explicitly asks for the device configuration and all available logs on every new ticket.

# Full diagnostic bundle TAC will ask for on almost every FortiGate ticket
execute tac report

# Save the session output to a file in your terminal client, then attach it.
# Also attach: a config backup (System > Configuration > Backup),
# relevant debug output, packet captures, and screenshots of errors.

Use this description template. It answers the questions the TAC engineer asks on the first call:

SUMMARY:      <one line: what is broken, on which device>
SERIAL / FW:  <FGxxxxxxxxxxxxxx> / <v7.x.x build xxxx>
ROLE:         <edge firewall / SD-WAN hub / HA A-P cluster member ...>
IMPACT:       <users/sites/services affected, revenue or safety impact>
STARTED:      <exact date and time, time zone>
CHANGES:      <upgrade from X to Y? config change? network change? none?>
WORKED BEFORE:<yes/no, since when>
REPRODUCE:    <exact steps>
ALREADY TRIED:<what you did and the result>
CONTACT:      <name, phone, hours, time zone of the device>
ATTACHED:     tac report, config backup, debug output, pcap

Step 3: Create the ticket in the Support Portal

Goal: a ticket number, routed to the right TAC team.

1. Log in to support.fortinet.com with the account that owns the device.
2. Go to Support > Manage Tickets > Create Ticket.
3. Pick the ticket type: Technical Support Ticket for product issues, Customer Service for licensing, account and ownership changes, Anti Virus / FortiGuard Service for AV, IPS signature and CVE questions, FortiConverter for conversion work.
4. Type at least three characters of the serial number and select the device from the list.
5. Enter the title, product category and firmware version, then select Next.
6. Paste the description template, attach the files from Step 2, and submit.

GUI verification: the ticket appears under Support > Manage Tickets with a ticket number and status Registered, and you receive a confirmation email.

Step 4: For P1 or P2, call TAC right away

Goal: get the ticket worked at critical priority.

Action: Fortinet’s recommended pattern is to open the web ticket first (so the logs are already attached), then immediately call the regional TAC toll-free number, quote the ticket number, and request the raise to P1 or P2. Fortinet requires telephone contact for every P1 and P2 ticket, both for creation and for any priority increase.

Have proof of business impact ready. Fortinet sets the final priority based on its definitions, not on what you selected.

Step 5: Work the ticket

Goal: keep the ticket moving and avoid an auto-close.

Action: watch the status (next section). Whenever it shows PendCustFB, the clock is on you. Reply with the requested data in the portal; the status flips to RcvdCustFB automatically and the action goes back to Fortinet.

Fortinet Ticket Status: What Each One Means

Every status change triggers an email. The one column that matters most is who owns the next action.

The auto-close timer

When a ticket is waiting on you, Fortinet automates the chase:

If you need time (change freeze, waiting on a maintenance window), tell the TAC engineer and ask for On Hold with a follow-up date instead of letting it drift to closure.

Fortinet Ticket Priority: P1, P2, P3 and P4

Priority is about business impact, not about which feature is broken. Fortinet measures it by the number of users affected and the financial impact, and Fortinet makes the final call using these definitions:

Workarounds downgrade the ticket

This surprises people. Once you accept a workaround, a P1 becomes a P2 and a P2 becomes a P3. Workarounds include reverting a config change, upgrading or downgrading firmware, replacing hardware, or a configuration change. The root-cause investigation continues, just at the lower priority.

Severity vs Priority: Where Severity Fits

Fortinet’s ticket SLAs are keyed to Priority only. The FortiCare documentation does not publish a separate severity scale for technical tickets, yet “severity” shows up constantly. It comes from three places, and mixing them up causes most of the confusion:

The practitioner rule: severity is how broken it is, priority is how fast Fortinet works it. A critical CVE on an internet-facing SSL VPN that is not under active exploitation is a patch-planning problem, so handle it through PSIRT guidance and, if you need help, a P3 or P4 ticket. The same CVE being actively exploited against live business services matches the P1 definition (“vital security flaw affecting active business services”), so call TAC.

When you write the ticket, state impact in Fortinet’s language: number of users, sites or sessions affected, whether it is production, and what it costs per hour. That is what moves a ticket from P3 to P1, not the word “critical”.

Fortinet Support SLA by Priority and FortiCare Tier

Two clocks matter, and neither is a resolution time:

• Initial Response Time: time until a qualified TAC engineer contacts you.
• Update Frequency Interval: maximum time between updates from the ticket owner while the action is with Fortinet.

Initial response time

Update frequency interval

Reading the table: Premium is the line most fleets live on, because the FortiGate UTP and Enterprise bundles include FortiCare Premium. Note that Premium’s P3 response is still next business day, the same as Essential. The faster P3 and P4 times are an Elite-only benefit.

FortiCare Essential vs Premium vs Elite

The tier is bought per serial number and drives far more than the response clock. Here is what actually changes:

What each tier is really for

• Essential: lab, branch spares and low-risk devices. The catch is not just speed: you cannot open or raise a P1 or P2 at all, and RMA is return-and-replace, so a dead box stays dead until Fortinet receives the faulty one.
• Premium: the default for production. Phone access to TAC 24×7, a 1-hour critical response and advanced replacement RMA. It comes in the FortiGate UTP and Enterprise bundles.
• Elite: data center cores, SD-WAN hubs and anything where an hour without a TAC engineer on the line is too long. It adds the 15-minute critical response, much faster P3/P4 handling, the Elite device health portal and 18 extra months of engineering support on LTS firmware, which buys time when you cannot upgrade on Fortinet’s lifecycle. Elite is sold standalone or as an upgrade on top of an active Premium contract.

Two related points that often get confused with the tier: an active FortiCare contract is required to upgrade FortiOS to a higher major or minor release (patch releases stay available for security fixes), and FortiCare Advanced Support (Core, Pro, Pro Plus) is a separate account-level service that adds a designated Technical Account Manager, root-cause analysis for P1/P2 incidents, operational reviews and upgrade assistance.

Raising Priority and Escalating a Ticket

These are two different things. Raising priority changes the SLA. Escalating gets management attention but does not automatically raise priority or guarantee a faster fix.

Before you escalate, Fortinet expects four things in place: all relevant data is in the ticket, the business impact or deadline is documented in the ticket, your management is informed and available, and your own technical staff are available to work with TAC (mandatory for a P1).

Verification and Validation

Use this checklist after you submit, so you know the SLA clock is actually running:

[ ] Confirmation email received with ticket number
[ ] Portal shows status: Registered  (then Researching once assigned)
[ ] Serial number on the ticket matches the affected device
[ ] Entitlement shows the tier you expect (Premium/Elite for P1/P2)
[ ] Priority on the ticket matches business impact
    - P1/P2: you called TAC and quoted the ticket number
[ ] Attachments uploaded: tac report, config backup, debugs, pcap
[ ] First contact arrives inside the Initial Response Time for your tier

Expected success state: within the initial response window (for example 1 hour for a Premium P1), a TAC engineer contacts you by phone or email, and the status moves from Registered to Researching.

Troubleshooting and Gotchas

1. The serial number does not appear when creating the ticket

Cause: the device is registered to a different FortiCloud account (often the reseller’s or a previous owner’s), or your user is not listed on the owning account, or the entitlement has expired.

Fix: check Product List > serial > Entitlement from the owning account. Have the organization’s master account admin add you as a user, or open a Customer Service ticket (or call Customer Service) to transfer registration. Partners can open a partner ticket on the customer’s behalf.

2. Production is down and nobody has called back

Cause: the ticket was opened on the web, so it is a P3 or P4 sitting in a next-business-day queue.

Fix: call the TAC toll-free number now, quote the ticket number, describe the business impact and request P1 or P2. Confirm the serial is on Premium or Elite; Essential cannot be raised.

3. The ticket closed itself before the maintenance window

Cause: it sat in PendCustFB for 10 days, moved to PendCloseConf, and auto-closed 5 days later. Closed tickets cannot be reopened.

Fix: open a new ticket referencing the old ticket number. Next time, ask the engineer to set On Hold with a follow-up date, or post a short update so the reminder clock resets.

Sources

• FortiCompanion to Technical Support
• FortiCare Case Priority
• How to create a ticket for Fortinet TAC
• FortiCare Services service brief
• FortiCare Elite service brief
• FortiGuard PSIRT Advisories