Fortinet black logo

Administration Guide

Licensing in an air-gap environment

Licensing in an air-gap environment

When performing the initial setup of FortiManager, you are required to register your FortiManager to FortiCare, which typically requires internet access. While operating in a closed network or air-gap environment, you must complete this step by uploading the entitlements file through the FortiManager CLI.

Tooltip

When internet access is restricted by a web proxy, you can establish a connection to FortiGuard for the FortiCare registration information or status using the following commands in the CLI:

config fmupdate av-ips web-proxy

set address <enter the web proxy address>

set port <enter the port number of the web proxy (1 - 65535, default = 80)>

set status enable

end

To register FortiManager in an air-gap environment:
  1. In FortiManager, disable access to the public FortiGuard Distribution Servers (FDS) using the following CLI commands:

    config fmupdate publicnetwork

    set status disable

    end

  2. Connect to the FortiManager GUI, and on the FortiManager login screen, click Upload License.

  3. Click Browse to select your FortiManager license or drag-and-drop the license file, and click Upload.

    The license file will be applied, and the FortiManager will be restarted in order to verify the license.
  4. Sign in to FortiManager.
    The FortiManager Setup Wizard is displayed.


    In order to access your FortiManager, it must be registered to FortiCare in the FortiManager Setup Wizard.
  5. On FortiCloud, create a ticket for your FortiManager entitlements file, and Fortinet Customer Service will provide you with the file.
  6. You can upload your entitlement file either through the setup wizard or through the FortiManager CLI.
    1. Onboarding wizard:
      1. Select Import the Entitlement File in the FortiManager Setup wizard.
      2. Drag and drop the entitlement file into the import area, or click Add Files to select the file location.

    2. Command line interface:
      1. Open the FortiManager CLI.
      2. Upload the entitlement file using the following command.

        execute fmupdate <ftp | scp | tftp> import license <filename> <server> <port> <directory> <username> <password>

        Tooltip

        The <port> variable is only required when connecting to a remote SCP host. The <directory>, <username>, and <password> variables are only required for logging into a FTP server or SCP host to download the file. For more information, see the FortiManager CLI Reference.

        For example:

        execute fmupdate ftp import license entitlement-file 172.10.1.10 /pub/place user1 password1

        This operation will replace the current package!

        Do you want to continue? (y/n)y

        Start getting file from FTP Server...

        Transferred 0.001M of 0.001M in 0:00:00s (0.008M/s)

        FTP transfer is successful.

        Package installation is in process...

        This could take some time.

        Update successfully

  7. The FortiManager Setup wizard will display that you are successfully registered with FortiCare.

Licensing in an air-gap environment

When performing the initial setup of FortiManager, you are required to register your FortiManager to FortiCare, which typically requires internet access. While operating in a closed network or air-gap environment, you must complete this step by uploading the entitlements file through the FortiManager CLI.

Tooltip

When internet access is restricted by a web proxy, you can establish a connection to FortiGuard for the FortiCare registration information or status using the following commands in the CLI:

config fmupdate av-ips web-proxy

set address <enter the web proxy address>

set port <enter the port number of the web proxy (1 - 65535, default = 80)>

set status enable

end

To register FortiManager in an air-gap environment:
  1. In FortiManager, disable access to the public FortiGuard Distribution Servers (FDS) using the following CLI commands:

    config fmupdate publicnetwork

    set status disable

    end

  2. Connect to the FortiManager GUI, and on the FortiManager login screen, click Upload License.

  3. Click Browse to select your FortiManager license or drag-and-drop the license file, and click Upload.

    The license file will be applied, and the FortiManager will be restarted in order to verify the license.
  4. Sign in to FortiManager.
    The FortiManager Setup Wizard is displayed.


    In order to access your FortiManager, it must be registered to FortiCare in the FortiManager Setup Wizard.
  5. On FortiCloud, create a ticket for your FortiManager entitlements file, and Fortinet Customer Service will provide you with the file.
  6. You can upload your entitlement file either through the setup wizard or through the FortiManager CLI.
    1. Onboarding wizard:
      1. Select Import the Entitlement File in the FortiManager Setup wizard.
      2. Drag and drop the entitlement file into the import area, or click Add Files to select the file location.

    2. Command line interface:
      1. Open the FortiManager CLI.
      2. Upload the entitlement file using the following command.

        execute fmupdate <ftp | scp | tftp> import license <filename> <server> <port> <directory> <username> <password>

        Tooltip

        The <port> variable is only required when connecting to a remote SCP host. The <directory>, <username>, and <password> variables are only required for logging into a FTP server or SCP host to download the file. For more information, see the FortiManager CLI Reference.

        For example:

        execute fmupdate ftp import license entitlement-file 172.10.1.10 /pub/place user1 password1

        This operation will replace the current package!

        Do you want to continue? (y/n)y

        Start getting file from FTP Server...

        Transferred 0.001M of 0.001M in 0:00:00s (0.008M/s)

        FTP transfer is successful.

        Package installation is in process...

        This could take some time.

        Update successfully

  7. The FortiManager Setup wizard will display that you are successfully registered with FortiCare.