Licensing

Please refer to the FortiNDR ordering guide for licensing details: https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/og-fortindr.pdf.

Customers must have the correct SKU for FortiNDR functionalities to work.

Netflow and OT Security Services licenses

Netflow and OT Security Services licenses are ordered separately for sensors and standalone deployment.

Expired licenses

License expiration affects VMs and hardware appliances differently:

License	Service impact
VM	The sniffer and IPS/ANN engine continue to process traffic with existing signatures, however users will lose access to the GUI, which redirects to the license upload page. Users will lose access to any FortiGuard updates (ANN, IPS, IOT updates, etc). Users lose access to any FortiGuard service lookups (webfilter, IOC lookups). If the VM is in Sensor mode, it will stop syncing data to Centers.
Hardware	The sniffer and IPS/ANN engine continues to process traffic with existing signatures. GUI access remains available in this case. Users will lose access to any FortiGuard: Updates (ANN, IPS, IOT updates, etc) Service lookups (webfilter, IOC lookups) If a physical appliance is in Sensor mode, data sync with any configured Center will continue and is not affected by the expired FortiNDR license.
OT	Users lose access to any FortiGuard OT updates. Traffic is processed with any existing OT signatures on the system.
Netflow	Access to existing processed Netflow results in GUI is turned off. The Netflow collector daemon and Netflow traffic processing are turned off.

There is no grace period for expired licenses.