Your FortiGate licence has expired. What now?

What keeps working when the licence expires

Your FortiGate does not shut down. Firewalling, NAT, routing, VPNs, existing policies — the core FortiOS features keep running exactly as configured. Nobody's internet goes down the morning after expiry, which is precisely why so many lapses go unnoticed for months.

What silently stops

• FortiGuard security updates. IPS signatures, antivirus definitions, web-filtering categories, antispam — all freeze at their last update. The features still run, but against an ageing threat database. Every day widens the gap between what your firewall knows and what attackers are doing.
• Technical support. No FortiCare means no Fortinet TAC when something breaks — and no advanced hardware replacement if the unit fails.
• Firmware upgrades. Since FortiOS 7.4.2, FortiGates without an active support contract are blocked from upgrading to new major and minor releases. An expired licence now also means being pinned to old firmware — including its known vulnerabilities.

There is a short grace period (around two days) during which services continue while a renewal registers — it's a buffer for paperwork, not a free extension.

The part most people don't know: back-dating

A renewal bought after expiry doesn't start on the day you pay. Under Fortinet's continuous-service rule, it's back-dated to your expiry date — the new term covers the gap first, then runs forward. Lapse six months on a 12-month renewal and you effectively get six months of forward cover.

The practical takeaway cuts both ways: waiting doesn't save money (you'll pay for the gap regardless), and a lapse isn't fatal (you can always get covered again — your compliance posture is restored back to the expiry date). The only winning move is renewing on time; the second-best move is renewing now. Our quotes show reinstatement options explicitly for lapsed devices.

"It expired ages ago — is renewing still worth it?"

Almost always, yes — a renewal is a fraction of the cost of new hardware plus a new licence. Two honest exceptions: if the model is approaching Fortinet's end-of-support date, or your throughput needs have outgrown it, put the money toward a replacement instead. Tell us the situation and we'll say plainly which side of that line you're on.

Fixing it from South Africa: three steps

1. Submit your serial. We verify the model and the real expiry against FortiCare — including how far back the lapse goes.
2. Approve the rand quote. Itemised, VAT included, showing the back-dating clearly. Reply-to-accept; procurement-friendly.
3. We register the renewal. Your FortiGate picks up the new entitlement automatically — or immediately if you run execute update-now on the CLI. If it still shows expired after that, that's a known sync quirk: give it up to a day or run the update command again.