FortiGate licence renewal: FortiCare, UTP and expiry dates

A FortiGate whose licence expires does not stop. It keeps passing traffic, users notice nothing, and that is precisely the danger: threat signatures are no longer updated, web filtering can no longer rate sites properly, and you lose vendor support and hardware replacement. Renewing on time means knowing what each subscription covers, anticipating the expiry date, aligning the dates of your appliances and using the renewal to review the protection level, or to replace an end-of-life model. Here is our method as a Fortinet partner.

What FortiCare and the bundles cover

Two families of subscriptions coexist on a FortiGate, each with its own expiry date visible in the interface and on the Fortinet support portal.

• FortiCare: vendor technical support, replacement of faulty hardware, access to new FortiOS firmware versions.
• FortiGuard services, sold as bundles: UTP (Unified Threat Protection) for the vast majority of SMBs, ATP for a narrower scope, Enterprise Protection for sensitive sites. They feed antivirus, intrusion prevention, web and DNS filtering, application control and anti-botnet.

Choosing the initial bundle is covered in FortiGate for SMBs: which model to choose. Here we focus on what happens next, at expiry.

What stops working at expiry

Item	With an active licence	After expiry
Routing, firewall rules, VPN	Working	Keep working
Antivirus and intrusion prevention	Signatures updated continuously	Signatures frozen at the expiry date
Web and DNS filtering	Sites rated by Fortinet’s cloud	Rating unavailable: depending on the setting, everything passes or everything is blocked
Application control	New applications recognised	Application database frozen
FortiOS firmware	New versions and patches downloadable	No access to new versions
Support and hardware replacement	Tickets, appliance swap	No tickets, no swap

Web filtering deserves particular attention. The FortiGate queries Fortinet’s cloud to find each site’s category. When the service expires, that query fails, and the behaviour depends on a setting: if the appliance allows sites when a rating error occurs, all browsing passes unfiltered; otherwise, users find themselves blocked. In the first case, nobody complains and the protection has quietly disappeared.

Firmware access is the other critical point. FortiOS security patches are released regularly, and some vulnerabilities directly affect VPN access or the administration interface. Without FortiCare, you can no longer apply them.

Planning the renewal

A successful renewal does not start in the week of expiry. The order goes through the partner and distributor channel, then the licence has to be applied to the right serial number. We recommend raising the subject several weeks before the expiry date.

As a general rule, a late renewal runs from the expiry date, not the order date: time spent without a licence is not recovered. Waiting therefore saves nothing; it only creates a period without protection.

Where to find the dates

• In the FortiGate interface, on the licence dashboard.
• On the Fortinet support portal, where the appliance is registered with its serial number.
• In your asset register, if your provider keeps it up to date.

Aligning dates: co-terming

A company with a head office and branches often ends up with FortiGates bought at different times, so expiry dates are scattered across the year. Co-terming brings these contracts onto a common date, so there is only one renewal a year and nothing gets forgotten. The terms depend on the existing contracts and the Fortinet channel; we check them case by case before quoting. In high availability, both appliances in the pair must be covered consistently: an unlicensed member weakens the whole cluster when it fails over.

Reviewing bundle and term at renewal

Expiry is the right time to ask whether the protection level still matches the business.

• FortiCare only: avoid it, the appliance filters almost nothing.
• UTP: the default choice for an SMB or a branch office.
• Enterprise Protection: worth considering if the company handles sensitive data, has faced an intrusion attempt, or if an insurer or major customer raises its requirements.

The term is also chosen at this point. A multi-year commitment simplifies management; a short renewal keeps flexibility if the appliance is due to be replaced in the medium term.

Renew or replace the appliance

Renewing the licence of an appliance reaching end of life makes no sense. Fortinet publishes the lifecycle of each model, with an end-of-order date and then an end-of-support date, after which the hardware is no longer covered and receives no new FortiOS versions. Before renewing, we check three points:

1. The published lifecycle: if end of support falls within the period you are about to pay for, replacement should be considered.
2. Actual load: an appliance that saturates with inspection enabled, or on which inspection was switched off to keep up, no longer protects properly.
3. New needs: faster fibre, a second link, new branches, wider remote work.

If any of these points is a blocker, replacing the appliance and licensing the new model is often more consistent. It is also the moment to reconsider the vendor, as we explain in FortiGate or WatchGuard.

Mistakes we come across

1. Discovering the expiry months later, while reading a log or after an incident.
2. Renewing FortiCare but forgetting the security bundle, or the other way round.
3. Leaving web filtering set to allow all sites on a rating error, with no alert.
4. Different expiry dates at every site, never aligned.
5. Renewing an appliance whose end of support is near.
6. A FortiGate registered to a former provider’s account, impossible to find at renewal time.

Renewal checklist

• FortiCare and bundle expiry dates recorded for each serial number.
• Appliances registered to an account in the company’s name.
• Reminder set several weeks before expiry.
• Co-terming considered for several appliances or a high-availability pair.
• Bundle reviewed against current needs.
• Model lifecycle and actual load checked before renewing.
• Licence applied and verified in the interface after renewal.
• Firmware brought up to date as soon as access is restored, following our 10 security settings after installing a FortiGate.

How we do it

We start with a free initial audit: inventory of your FortiGates, serial numbers and expiry dates, review of the configuration and actual load. For each appliance we then propose a renewal, co-terming or replacement, with a clear quote. Once in place, expiry dates are tracked in our 24/7 monitoring, together with firmware updates and rule reviews; a critical incident is handled in under 15 minutes. This follow-up is part of our cybersecurity offering. If you are choosing a new firewall, our business firewall buying guide for Morocco covers all the criteria, and our case studies show comparable, anonymised projects.

Is your FortiGate licence about to expire, or are you no longer sure when? Contact us: we reply within 24 business hours.