Licensing in an air-gap environment

When performing the initial setup of FortiManager, you are required to register your FortiManager to FortiCare, which typically requires internet access. While operating in a closed network or air-gap environment, you must complete this step by uploading the entitlements file through the FortiManager CLI.

When internet access is restricted by a web proxy, you can establish a connection to FortiGuard for the FortiCare registration information or status by configuring a web proxy. See Enabling updates through a web proxy.

To register FortiManager in an air-gap environment:

1. In FortiManager, disable access to the public FortiGuard Distribution Servers (FDS) using the following CLI commands:

   config fmupdate publicnetwork

   set status disable

   end

2. Connect to the FortiManager GUI, and on the FortiManager login screen, click Upload License.
   
   
3. Click Browse to select your FortiManager license or drag-and-drop the license file, and click Upload.
   
   The license file will be applied, and the FortiManager will be restarted in order to verify the license.
4. Sign in to FortiManager.
   The FortiManager Setup Wizard is displayed.
   
   
   In order to access your FortiManager, it must be registered to FortiCare in the FortiManager Setup Wizard.
   
5. On FortiCloud, create a ticket for your FortiManager entitlements file, and Fortinet Customer Service will provide you with the file.
   
6. You can upload your entitlement file either through the setup wizard or through the FortiManager CLI.
   1. Onboarding wizard:
      1. Select Import the Entitlement File in the FortiManager Setup wizard.
      2. Drag and drop the entitlement file into the import area, or click Add Files to select the file location.
         
         
   2. Command line interface:
      1. Open the FortiManager CLI.

      2. Upload the entitlement file using the following command.

         execute fmupdate <ftp | scp | tftp> import license <filename> <server> <port> <directory> <username> <password>

         The <port> variable is only required when connecting to a remote SCP host. The <directory>, <username>, and <password> variables are only required for logging into a FTP server or SCP host to download the file. For more information, see the FortiManager CLI Reference.

         For example:

         execute fmupdate ftp import license entitlement-file 172.10.1.10 /pub/place user1 password1

         This operation will replace the current package!

         Do you want to continue? (y/n)y

         Start getting file from FTP Server...

         Transferred 0.001M of 0.001M in 0:00:00s (0.008M/s)

         FTP transfer is successful.

         Package installation is in process...

         This could take some time.

         Update successfully

7. The FortiManager Setup wizard will display that you are successfully registered with FortiCare.