FortiGate Upgrade Using Off License Key

I was performing a FortiGate firmware upgrade via both web GUI and TFTP but it's giving me a license error. Per the Fortinet link, starting FortiOS 7.4.2 and above, enforcement of an active FortiGate firmware license to allow firmware upgrades has been improved. Enforcement is based on the expiry date of the current firmware license compared to the release date of the first GA release of a major or minor version. For example, for FortiOS 7.4.x firmware upgrades, enforcement is based on the expiry date of the current support contract compared to the release date of FortiOS 7.4.0 GA.

This is the error message when you perform the firmware upgrade via web GUI: System > Firmware & Registration > File Upload > select target firmware image file.

You can use the execute restore image tftp <filename.out> <tftp_server_ip> CLI command to upgrade firmware via a TFTP server. Just directly connect an RJ45 cable from your PC LAN to the MGMT port and set the PC LAN adapter to auto obtain an IP address. The MGMT IP address is usually set to 192.168.1.99/24. 

FortiGate # execute restore image tftp FGT_xF-v7.6.x.M-build36xx-FORTINET.out 192.168.1.110
This operation will replace the current firmware version!
Do you want to continue? (y/n)y

Please wait...

Connect to tftp server 192.168.1.110 ...
##################################

Get image from tftp server OK.
Verifying the signature of the firmware image.
Image verification OK!
Warning: Installing image v7.6.x from v7.4.x may result in loss of configuration. Do you want to proceed?
Do you want to continue? (y/n)y

Warning: Upgrading to an image with Mature maturity notation.

Firmware update license is expired! Please update to a valid license.
Command fail. Return code -180


Per the Fortinet link, an alternative solution is to register the FGT device in FortiCloud using the FortiCloud key, download the license file and manually register it offline. This is useful for FGT deployed in a very secure or air-gapped network wherein there's no Internet connectivity to FortiCloud. Below is the FortiCloud key sticker in the FortiGate chassis.

Register the FGT using its serial number and key in FortiCloud.

Once FGT device is registered in FortiCloud, you can download the Off-Network license (.lic) file which is found under the License & Key section.

You can upload the license file under System > FortiGuard > FortiGuard update > Upload License File. It will instantly change its status to Registered/Licensed (green).

You're now allowed to perform the firmware upgrade. 

FortiGate# Image verification OK!

 

Firmware upgrade in progress ...

Done.

 

The system is going down NOW !!

 

Please stand by while rebooting the system.

Restarting system.

  

FortiGate-x (17:52-09.19.2025)

Ver:05000203

Serial number: FG1xTK25001234

CPU: 1400MHz

Total RAM: 8 GB

Initializing boot device...

Initializing MAC... NP6XLITE#0

Please wait for OS to boot, or press any key to display configuration menu......

 

Booting OS...

Initializing firewall...

 

System is starting...

<OUTPUT TRUNCATED>

FortiGate-1x # get system status
Version: FortiGate-101F v7.6.x,build3x (GA.M)
First GA patch build date: 24x
Current Security Level: High
Firmware Signature: certified
Virus-DB: 1.00000(2018-04-09 18:07)
Extended DB: 1.00000(2018-04-09 18:07)
AV AI/ML Model: 0.00000(2001-01-01 00:00)
IPS-DB: 6.00741(2015-12-01 02:30)
IPS-ETDB: 0.00000(2001-01-01 00:00)
IPS-MLDB: 0.00000(2001-01-01 00:00)
APP-DB: 6.00741(2015-12-01 02:30)
Telemetry-DB: 1.00005(2026-07-22 05:52)
AIAP-DB: 0.00000(2001-01-01 00:00)
Proxy-IPS-DB: 6.00741(2015-12-01 02:30)
Proxy-IPS-ETDB: 0.00000(2001-01-01 00:00)
Proxy-APP-DB: 6.00741(2015-12-01 02:30)
FMWP-DB: 0.00000(2001-01-01 00:00)
IPS Malicious URL Database: 1.00001(2015-01-01 01:01)
IoT-Detect: 0.00000(2022-08-17 17:31)
OT-Detect-DB: 0.00000(2001-01-01 00:00)
OT-Patch-DB: 0.00000(2001-01-01 00:00)
OT-Threat-DB: 6.00741(2015-12-01 02:30)
IPS-Engine: 7.01168(2025-11-19 22:37)
Timezone DB Version: 1.003
Timezone DB IANA Version: 2024a

<OUTPUT TRUNCATED>
 

Release Version Information: GA
System time: Wed Jul 22 05:56:41 2026
Last reboot reason: warm reboot
 

Patching FortiBleed VPN Credential Leak

There was a recent FortiGate SSL VPN vulnerability, commonly referred to as FortiBleed, disclosed by Fortinet. You can verify under the SSL VPN setting if it's explicitly enabled. The Fortinet PSIRT advisory also outlined the mitigation steps and required software patch to address the said vulnerability. 

 

FGT # config vpn ssl settings

 

FGT (settings) # show

config vpn ssl settings

    set banned-cipher SHA1 SHA256 SHA384

    set servercert ''

    set port 443

end

FGT(settings) # set status

enable     Enable Agentless VPN.

disable    Disable Agentless VPN.

Per the Fortinet Tech Tip, starting FortiOS 7.2.11 and above use PBKDF2 for hashing the local admin password. You can confirm this with the "ENC PB2" used in the password encryption. Prior to 7.2.11, it uses SHA256.

 

FGT (global) # config system admin

FGT  (admin) # edit "fw-admin"

FGT (fw-admin) # show

config system admin

    edit "fw-admin"

        set vdom "root"

        set accprofile "super_admin"

        set password ENC PB2abcdOMd71rT5MBTtJ2QTOmeb8M3Q4KglpTwQTCP/q5Xg06bEjO4FGR9TvjeAFa+BgL6JRv9vrq0GHL93u8kbt8QoWtvZV0pvMoUqI123456=

    next

end

FortiGate show full-configuration (terminal length 0)

You'll need to configure set output standard in order to view the FortiGate's full configuration without pause. This is similar to the terminal length 0 (in a Cisco IOS-XE device) or terminal page 0 (in Cisco ASA firewall). This is helpful when you want to save the full config into a text file using SecureCrt or PuTTY. The default uses the more option wherein you hit Enter to continue viewing the configuration pages.

Note this is a persistent config, so you'll need to configure either the more or standard output when you login again to the FortiGate.

 

FGT # config 
global    config global
vdom      config vdom

FGT # config global

FGT (global) # show full-configuration
config system global
    set admin-ble-button enable
    set admin-concurrent enable
    set admin-console-timeout 0
    set admin-forticloud-sso-login disable
    set admin-host ''
    set admin-hsts-max-age 15552000
    set admin-https-pki-required disable
    set admin-https-redirect enable
    unset admin-https-ssl-banned-ciphers
    set admin-https-ssl-ciphersuites TLS-AES-xx
    set admin-https-ssl-versions tlsv1-3
    set admin-lockout-duration 300
    set admin-lockout-threshold 5
    set admin-login-max 100
    set admin-port 80
    set admin-reset-button enable
    set admin-restrict-local enable
    set admin-scp disable
    set admin-server-cert "Fortinet_GUI_Server"
    set admin-sport 443
    set admin-ssh-grace-time 120
    set admin-ssh-password enable
    set admin-ssh-port 22
    set admin-ssh-v1 disable
    set admin-telnet disable
    set admintimeout 15
    set alias "FortiGate-xx"
    set allow-traffic-redirect enable
    set anti-replay strict
    set arp-max-entry 131072
    set auth-cert "Fortinet_Factory"
    set auth-http-port 1000
    set auth-https-port 1003
    set auth-ike-saml-port 1001
    set auth-keepalive disable
    set auth-session-limit block-new
    set auto-auth-extension-device enable
    set autorun-log-fsck disable
    set av-affinity "0"
    set av-failopen pass
    set av-failopen-session disable
    set batch-cmdb enable
--More-- 


FGT (global) # config system console

FGT (console) # set output 
standard    Standard output.
more        More page output.
 
FGT (console) # set output standard   
 
FGT (console) # end
 
FGT (global) # show full-configuration

<OUTPUT TRUNCATED>

config system ipam
    set status disable
    set server-type fabric-root
    config pools
        edit "default-pool"
            set description ''
            set subnet 172.31.0.0 255.255.0.0
        next
        edit "lan-pool"
            set description ''
            set subnet 192.168.0.0 255.255.0.0
        next
    end
    config rules
        edit "role-lan"
            set description ''
            set device "*"
            set interface "*"
            set role lan
            set pool "lan-pool"
            set dhcp enable
        next
    end
end
config system fabric-vpn
    set status disable
end
 
FGT (global) # 

FortiGate Restore Configuration Revision

Here's a Fortinet link on how to save and restore config using revisions in a FortiGate firewall.

In FGT web GUI, click Profile name (upper right corner) > Configuration > Revision > Save Changes > optionally type a Comment.

The saved config includes all of the Virtual Domain (VDOM).

In FGT CLI, you use the execute revision list config and execute restore config flash commands. Just take note of the revision ID. The FGT will be rebooted in order to apply the config.

FGT# config global

FortiGate (global) # execute revision list config

Last Firmware Version: V0.0.0-build000-REL0

 

ID  TIME                   ADMIN             FIRMWARE VERSION           COMMENT

1   2024-10-07 10:13:23    daemon_admin      V7.2.x-build1xx-REL0     Automatic backup (upgrade)

2   2024-10-16 02:46:25    admin             V7.2.x-buildxx-REL0     Automatic backup (logout)

<OUTPUT TRUNCATED>

27  2025-10-18 02:13:56    Admin-Full   V7.2.x-buildxx-REL0   For CLI backup

 

 

FGT (global) # execute restore config flash

<revision>    Revision ID on the flash.

 

FGT (global) # execute restore config flash 27

FortiGate Manual HA Failover (Reset Uptime) Using CLI

Here's a link in troubleshooting FortiGate HA.

In my opinion, it's better to reset the FortiGate device uptime to manually restore or revert the original Primary firewall. Refer to this link to troubleshoot and interpret HA flags.

Check if the Secondary FortiGate firewall has the HA override disable and note the HA failover status flag.

FW01_SEC # show system ha | grep override

    set override disable

 

FW01_SEC # execute ha failover status

failover status: unset

 

 

The Secondary is acting as the Primary device in the High Availability (HA) cluster since its uptime is "larger" or device is up for a longer period of time. Also note the cluster index number for Primary and Secondary.

 

FW01_SEC # get system ha status

HA Health Status: OK

Model: FortiGate-4xxF

Mode: HA A-P

Group Name: FW01_CLUSTER

Group ID: 0

Debug: 0

Cluster Uptime: 6 days 13h:16m:48s

Cluster state change time: 2026-02-11 02:49:32

Primary selected using:

   <2026/02/11 02:49:32> vcluster-1: FG4H1FT922904444 is selected as the primary because its uptime is larger than peer member FG4H1FT922903333.

    <2026/02/11 02:46:27> vcluster-1: FG4H1FT922904444 is selected as the primary because it's the only member in the cluster.

    <2026/02/11 02:46:23> vcluster-1: FG4H1FT922904444 is selected as the primary because the value of link-failure + pingsvr-failure is less than peer member FG4H1FT922903333.

    <2026/02/11 02:42:49> vcluster-1: FG4H1FT922904444 is selected as the primary because it's the only member in the cluster.

ses_pickup: enable, ses_pickup_delay=disable

override: disable

Configuration Status:

    FG4H1FT922904444(updated 5 seconds ago): in-sync

    FG4H1FT922904444 chksum dump: bd 22 46 7c 8c bb f6 c6 73 54 f6 d2 d2 18 5a 1c

    FG4H1FT922903333(updated 1 seconds ago): in-sync

    FG4H1FT922903333 chksum dump: bd 22 46 7c 8c bb f6 c6 73 54 f6 d2 d2 18 5a 1c

System Usage stats:

    FG4H1FT922904444(updated 5 seconds ago):

        sessions=141, average-cpu-user/nice/system/idle=0%/0%/0%/99%, memory=28%

    FG4H1FT922903333(updated 1 seconds ago):

        sessions=14, average-cpu-user/nice/system/idle=0%/0%/0%/99%, memory=28%

HBDEV stats:

    FG4H1FT922904444(updated 5 seconds ago):

        ha: physical/1000auto, up, rx-bytes/packets/dropped/errors=4451813/18881/0/0, tx=27633523/26727/0/0

    FG4H1FT922903333(updated 1 seconds ago):

        ha: physical/1000auto, up, rx-bytes/packets/dropped/errors=26923055/24401/0/0, tx=4104707/17586/0/0

MONDEV stats:

    FG4H1FT922904444(updated 5 seconds ago):

        po1: aggregate/00, up, rx-bytes/packets/dropped/errors=51451719/86317/0/0, tx=11192875/63943/0/0

        po2: aggregate/00, up, rx-bytes/packets/dropped/errors=1856442/13545/0/0, tx=7439384/11524/0/0

    FG4H1FT922903333(updated 1 seconds ago):

        po1: aggregate/00, up, rx-bytes/packets/dropped/errors=422826/4005/0/0, tx=27924/157/0/0

        po2: aggregate/00, up, rx-bytes/packets/dropped/errors=382016/3818/0/0, tx=23840/153/0/0

number of member: 2

FW01_SEC, FG4H1FT922904444, HA cluster index = 1

FW01_PRI, FG4H1FT922903333, HA cluster index = 0

number of vcluster: 1

vcluster 1: work 169.254.0.2

Primary: FG4H1FT922904444, HA operating index = 0

Secondary: FG4H1FT922903333, HA operating index = 1

 

 

To reset the Secondary uptime, use the diagnose sys ha reset-uptime command. This will disconnect your current HTTPS/GUI session.

 

FW01_SEC # diagnose sys ha reset-uptime

 

 

Once you've re-login, notice the device hostname is back to the original Primary firewall.

 

FW01_PRI # get system ha status

HA Health Status: OK

Model: FortiGate-4xxF

Mode: HA A-P

Group Name: FW01_CLUSTER

Group ID: 0

Debug: 0

Cluster Uptime: 6 days 13h:28m:37s

Cluster state change time: 2026-02-11 03:16:05    //

Primary selected using:

   <2026/02/11 03:16:05> vcluster-1: FG4H1FT922903333 is selected as the primary because its uptime is larger than peer member FG4H1FT922902544.

    <2026/02/11 02:49:32> vcluster-1: FG4H1FT922904444 is selected as the primary because its uptime is larger than peer member FG4H1FT922903333.

ses_pickup: enable, ses_pickup_delay=disable

override: disable

Configuration Status:

    FG4H1FT922903333(updated 4 seconds ago): in-sync

    FG4H1FT922903333 chksum dump: bd 22 46 7c 8c bb f6 c6 73 54 f6 d2 d2 18 5a 1c

    FG4H1FT922904444(updated 4 seconds ago): in-sync

    FG4H1FT922904444 chksum dump: bd 22 46 7c 8c bb f6 c6 73 54 f6 d2 d2 18 5a 1c

System Usage stats:

    FG4H1FT922903003(updated 4 seconds ago):

        sessions=112, average-cpu-user/nice/system/idle=0%/0%/0%/99%, memory=28%

    FG4H1FT922904444(updated 4 seconds ago):

        sessions=28, average-cpu-user/nice/system/idle=0%/0%/0%/99%, memory=28%

HBDEV stats:

    FG4H1FT922903333(updated 4 seconds ago):

        ha: physical/1000auto, up, rx-bytes/packets/dropped/errors=29469319/30468/0/0, tx=6424709/23514/0/0

    FG4H1FT922904444(updated 4 seconds ago):

        ha: physical/1000auto, up, rx-bytes/packets/dropped/errors=6786743/24841/0/0, tx=30193967/32825/0/0

MONDEV stats:

    FG4H1FT922903333(updated 4 seconds ago):

        po1: aggregate/00, up, rx-bytes/packets/dropped/errors=1689444/9284/0/0, tx=523774/2771/0/0

        po2: aggregate/00, up, rx-bytes/packets/dropped/errors=791925/7447/0/0, tx=1255468/1865/0/0

    FG4H1FT922904444(updated 4 seconds ago):

        po1: aggregate/00, up, rx-bytes/packets/dropped/errors=54864434/101059/0/0, tx=14252015/75175/0/0

        po2: aggregate/00, up, rx-bytes/packets/dropped/errors=2300163/18051/0/0, tx=8158689/15016/0/0

number of member: 2

FW01_PRI, FG4H1FT922903333, HA cluster index = 0

FW01_SEC, FG4H1FT922904444, HA cluster index = 1

number of vcluster: 1

vcluster 1: work 169.254.0.1

Primary: FG4H1FT922903333, HA operating index = 0

Secondary: FG4H1FT922904444, HA operating index = 1

Cisco Firepower SNMP OID Bug (CSCvd33367)

We've been trying to poll our Cisco Firepower 2100 (ASA) and Cisco Secure 3100 (ASA) to monitor the device power supply, fan and temperature sensor in our NMS via SNMP. Currently, we can only monitor device CPU and memory. Cisco TAC has confirmed that there's a bug (CSCvd33367) and it seem an engineering bug (Severity 6/Enhancement). Cisco TAC haven't resolved this issue in a long time (since February 2017) and there's no workaround.

We've raised this to our Cisco Account Manager to raise this to their engineering hoping this would resolved anytime soon. Below is a snippet from the said bug:

 

SNMP OID's for Disk, Fan and power supply

 

Description:

SNMP monitoring on the firepower is based on OID's. Actually firepower manages basic linux OIDs, customer would like to use also those OID's for monitoring Firepower status. Moreover, there is a more stringent need to have storage OIDs for pure ASAs which are not FMC managed to have disk monitoring in FMC.

 

Symptom:

The customer would like to use SNMP to monitor Fan, power supply and Raid disk status with the OID's for those features on the FP. He would like to know if those OID's can be included in future releases and that way he can monitor tose features using OIDs.

 

Conditions:

Firepower does not have OID's available for monitoring fan, power supply and Raid disk status.

 

Workaround: N/A

 

Further Problem Description: N/A

Note that its Severity is “6 Enhancement”, which means that Cisco Engineering is not looking at this behavior as a “bug” per se.  That is, from Engineering’s viewpoint, the product is working as designed and this CDETS ID represents a request to enhance the original behavior. Feature enhancements are pushed by Sales account teams into Product Marketing, which prioritizes enhancement requests back to Engineering.

Check the FortiGate NAT Session Count Using Filters

Here's a quick way to check the FortiGate NAT session count and filter the NAT IP pool via the get sys session list | grep -c CLI command. This command is found in the Fortinet Tech Tip link.

 

FGT# get sys session list | grep -c 216.1.1.50

2096

 

FGT# get sys session list | grep -c 216.1.1.51

1774

You can also filter using a Policy ID.

FGT# get sys session list | grep -c 106

1085 

FGT# get sys session list | grep -c 137

673