Why is the FortiGate-VM license not active after deployment?

After you deploy a FortiGate-VM instance, the license status shows as inactive or unlicensed in the FortiGate web console.

When you log in to the FortiGate web console and navigate to System > FortiGuard, the license status appears as Invalid, Expired, or Not registered, and FortiGuard services are not available.

The FortiGate-VM license is retrieved and installed automatically during initial startup. FortiOS calls the IBM Cloud instance metadata authentication APIs to obtain an identity token, then calls the software attachments endpoint to retrieve the FortiFlex license key. It installs the key and restarts, then contacts Fortinet FortiCloud to complete validation. License activation can fail for several reasons:

  • The Instance Metadata Service was not enabled at deployment time.
  • Cloud-init did not complete successfully, preventing the license retrieval script from running.
  • The instance could not reach the Fortinet FortiFlex platform during initial startup, for example due to a missing floating IP, public gateway, or a security group blocking outbound traffic on UDP 53, TCP 443, or TCP 8890.
  • The FortiGate-VM instance was deployed without using the IBM Cloud Schematics automation, which handles license provisioning.

Try the following steps to resolve the issue:

  1. Verify that the Instance Metadata Service and Secure options are enabled. In the IBM Cloud console, navigate to Infrastructure > Compute > Virtual server instances and open your FortiGate-VM instance. Scroll to the end of the overview page and confirm that the Metadata service is set to Enabled and that the Secure option is also enabled. If either is disabled, enable it and restart the instance.

    VSI Metadata details showing Metadata service and Secure access enabled

  2. Review the Schematics workspace log. Open the Schematics workspace that was used to deploy the firewall and review the Terraform log for errors. Confirm that both Terraform commands successful and Cart creation successful are displayed at the end of the log.

  3. Check outbound connectivity from the FortiGate-VM. The FortiGate-VM must be able to reach Fortinet licensing servers on the internet. Verify that the VPC has a public gateway that is attached to the subnet used by port1, or that a floating IP is assigned to port1. Also confirm that the security group on port1 allows egress traffic on UDP 53, TCP 443, and TCP 8890. From the FortiGate CLI, run:

    execute ping guard.fortinet.net

    If the ping fails, check VPC routing and security group outbound rules.

  4. Review the FortiOS cloud-init log. Run the following command on the FortiGate CLI to see the detailed license injection log:

    diagnose debug cloudinit show

    A successful injection ends with VM license install succeeded. Will reboot firewall., as shown in the following example:

    >> 2026-06-26 10:36:56 IBM metadata swat found entitlement, key: ***, sku: fortiflex, vendor name: fortinet
>> 2026-06-26 10:36:56 IBM metadata swat successfully parsed entitlement
>> 2026-06-26 10:36:56 Trying to install vmlicense ...
>> 2026-06-26 10:36:56 License-token:***
VM license install succeeded. Will reboot firewall.

    If the log shows Failed to request forticare license lines, as shown in the following example, the instance could not reach FortiCloud during the initial boot:

    >> 2026-06-26 10:36:56 Trying to install vmlicense ...
>> 2026-06-26 10:36:56 License-token:***
>> 2026-06-26 10:37:27 Failed to request forticare license 28.
>> 2026-06-26 10:37:27 Forticare response error 58.
>> 2026-06-26 10:38:27 Failed to request forticare license 28.
>> 2026-06-26 10:38:42 Failed to request forticare license -1.
>> 2026-06-26 10:39:44 Failed to install license-token:-1

    Resolve the connectivity issue described in the previous step, then stop and start the virtual server instance to retrigger the injection.

  5. Restart the FortiGate-VM instance. If the Instance Metadata Service is now enabled and outbound connectivity is confirmed, stop and start the virtual server instance to trigger cloud-init to run again. License validation by FortiCloud typically completes within a few minutes but can take up to an hour.

  6. If the license is still not active after completing these steps, open an IBM support case. Include the virtual server instance ID, VPC ID, Schematics workspace ID, the output of diagnose debug cloudinit show, and the relevant Schematics log output.