Feature is configured and no valid license backs it
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
A feature that needs a subscription does not receive the content updates or cloud lookups it depends on once the subscription is missing or has ended. The configuration still shows it as switched on, so nobody sees it stopped working.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Renew or add one of the licenses named in the finding, or remove the feature from the rules that use it.
- Activate the license on the device and read it again to confirm it now appears with a future end date.
Command line
FortiOS CLI
config system autoupdate scheduleset status enableset frequency automaticend
An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. FortiOS saves a change when you type next or end, with no separate commit. Read every line first.
Read it back
get system fortiguard-service statusdiagnose autoupdate versionsget system status
Before you type it3
- Written from the FortiOS CLI Reference, not yet run on a device. Read each line before typing it.
- On a device with VDOMs, type these inside the VDOM (config vdom, edit the VDOM) or inside config global for a global setting.
- A FortiGate takes its subscriptions from FortiCare. Register the contract to the unit in FortiCare first. Automatic updates let the device pick it up.
How to confirm the fix
- Read the device's licenses again and confirm the license is listed with an end date in the future.
- Check that the feature's content database shows a recent update after the license is active.
Limits
- The license reading shows what the device holds on the day it was read. It does not show whether the feature works today.
- Two licenses can unlock some features. The finding fires only when none of the listed ones is valid.
- A FortiGuard service the device reports no contract date for is read as unlicensed. A device that has not reached FortiGuard recently may show that for a service it does hold; read the licenses through the API for a firm answer.
Compliance references
No benchmark recommendation is mapped to this control in this version.
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.