A FortiGate firewall is hardware, but much of its protection depends on licences. When a licence expires, the internet usually keeps working, which is why the problem is often noticed only after something has gone wrong. This article explains what each licence gives you and what actually changes when it expires.
FortiCare and FortiGuard: two different things
- FortiCare is the support contract: access to Fortinet technical support, firmware updates and hardware replacement (RMA) if the device fails.
- FortiGuard covers security services: antivirus signatures, IPS signatures, web filter categories, application detection and so on. These are updated continuously from the Fortinet cloud.
They are usually bought together as a bundle. The common bundles are below (exact contents depend on the model and FortiOS version and can change over time, so always check the current datasheet):
| Bundle | Roughly includes |
|---|---|
| ATP (Advanced Threat Protection) | Core threat protection: antivirus, IPS, sandbox-style analysis and FortiCare support. |
| UTP (Unified Threat Protection) | Everything in ATP plus web filtering, application control and antispam. The most common choice for a small office. |
| Enterprise Protection | Everything in UTP plus additional services for larger organisations, such as security ratings and more detailed device detection. |
What stops working on expiry, and what keeps working
Keeps working: basic firewalling, routing, NAT, DHCP, firewall policies and VPN connections. The office internet and remote-work VPN do not drop because a licence expired.
Stops working or becomes ineffective:
- Signature updates. Antivirus and IPS keep using the last downloaded signatures, but new threats are not recognised. After a few weeks the protection is effectively out of date.
- Web filter ratings. The web filter looks up site categories in the FortiGuard cloud. Without a valid licence, lookups fail and, depending on configuration, either all sites are allowed unfiltered or sites start being blocked. Both are bad.
- Support and RMA. If the device fails, you cannot open support tickets or get a replacement unit.
- Firmware downloads. Without valid FortiCare you cannot download new FortiOS versions, so security fixes are not installed. This is often the biggest risk.
How to check the expiry date
- Log in to the FortiGate web interface.
- Dashboard → Status: the Licenses widget shows the state of each service. Red or amber means expired or expiring soon.
- System → FortiGuard: shows the exact expiry date of each service (FortiCare, AntiVirus, IPS, Web Filtering etc.) and when it was last updated.
- All registered devices are also listed under your account in the Fortinet support portal.
Renewal tips
- Renew before expiry. Put the date in your calendar at least a month ahead. A late renewal is normally counted from the previous expiry date, so waiting does not save money; it just leaves you unprotected in between.
- Align the dates. If you have several FortiGates, FortiSwitches or FortiAPs, ask your reseller about co-terming so all licences expire on the same day and are easier to manage.
- Consider multi-year terms. A longer term is often cheaper per year and reduces the risk of forgetting.
- Check after activation. After activating a new licence, look at System → FortiGuard to confirm the dates have changed and signatures are updating.
When to call a professional
If you are unsure which bundle suits your model, or the licences have already lapsed, a reseller can find the right product code and align the dates. ITABIKS also supplies Fortinet licences and renewals; see Fortinet licences or call +372 53 888 229.