What Happens When Your Support Lapses on a FortiGate?

In many cases, you may not realize it when your FortiGate support lapses. The FortiGate will lose the ability to update its signatures from FortiGuard and you wont be entitled to contact support. Also, any policy that blocks traffic based on Web Filtering or DNS Filtering, will fail the lookup in the FortiGuard DB. This means that traffic will be dropped. Other than these things, the FortiGate functions the same. Your VPN tunnels, VIPs, routing protocols, DPI, etc. will continue to work.

Without Web Filtering or DNS Filtering and no access to support or updates, your firewall is very quickly becoming less effective. Here are some tips.

1. Don’t Panic

Any physical FortiGate or Perpetual License VM you bought will still pass most* traffic. Panic can cause mistakes.

2. Check Your Existing Policies

Examine your policies. Are any of them using Web Filtering? Are any of them using DNS Filtering? You will need to have a whitelist ready or turn off the filtering altogether until you have your new support.

3. Ask Your Organization to Renew

Make sure someone in your organization is actively working to get the license renewed. Make sure the order is going through your internal process and then reach out to your partner and account team to “follow” the order through to completion. You want to get support back and access to the FortiGuard Services. That hardens your device even more.

4. Ask Your Team About a Temporary License or Extension

In some cases, your account team can help with temporary or extended licenses. Let’s say a PO was already cut to the partner and you are just waiting on the fulfillment of the licenses. Ask your team to take that existing order to “the bosses” and get approval to bridge the gap while you are waiting on the fulfillment process. You will likely have to provide some items for proof. Sometimes you can’t get them extended, but it is worth asking.

5. Execute Update

The FortiGate needs to know when the contract is extended. Rather than wait until it updates itself, tell it to validate the license by going to the CLI and typing execute update-now​ 

The above information is only for physical and perpetual VM licenses. If you have an evaluation license from, say, a Proof of Concept you were working on, it will stop passing traffic and not be recoverable once the license expires. You have to get an extension BEFORE the expiration.

Lastly, for the marketplace stuff on AWS, Azure, GCP, and other clouds, if you don’t pay your “Pay-as-you-go” licenses, the FortiGates completely stop passing traffic at that point.

In conclusion, in most cases, it is not the “end of times” scenario if support lapses as long as you rememdy it ASAP, but it can be a little bit of a headache.