Firewall FAQ and Troubleshooting
This page covers common questions you can usually resolve yourself, without raising a support ticket.
There are two independent things that can be "out of sync" after a plan change, and they're fixed differently:
- Your MyAccount dashboard — the plan, price, and configuration shown on the Firewall Detail page. This is E2E's own record of your firewall.
- Your FortiGate's Fortinet subscription/entitlement — the FortiFlex license and any FortiGuard security bundles running on the firewall itself. This is managed by Fortinet.
Normally both update automatically. The steps below are for when one of them doesn't.
My dashboard still shows the old plan after an upgrade. What should I do?
- Wait a few minutes. The dashboard reflects the upgraded plan automatically shortly after the upgrade completes.
- If it still doesn't update, reboot your firewall. Go to the firewall's Actions menu and select Reboot. This is the standard fix and resolves the vast majority of cases — see Reboot.
- If it still doesn't update after a reboot, raise a support ticket with your firewall name and the plan you upgraded to. Don't keep retrying the upgrade — a stuck dashboard display is a display-sync issue, not a sign that the upgrade itself failed.
I enabled a FortiGuard security bundle, but the firewall doesn't seem to recognize it. What can I try?
This is a Fortinet-side subscription check, separate from your MyAccount dashboard. On the FortiGate CLI, you can force a signature and license recheck:
execute update-now
execute update-now forces a full AV/IPS signature database update and performs a license check as part of that process. It is not a dedicated "refresh my plan" command — its primary purpose is signature updates — but the license check it triggers can pick up a newly recognized subscription. The update can take a few minutes to complete.
If the bundle still isn't recognized after this, raise a support ticket with E2E support — they'll coordinate with the Fortinet entitlement backend on your behalf.
How do I manually inject a FortiFlex license token, if I've been given one?
In almost all cases, you never need to do this — E2E provisions and re-applies your FortiFlex license automatically on create, power on, and reinstall (see Licensing). The one exception is a legacy FortiFlex migration, where E2E emails you a license token directly. If that migration email's automatic activation didn't take effect, you can inject the token yourself from the FortiGate CLI:
execute vm-license <license_token>
For example:
execute vm-license 58923569A3FFB7F46879
If your FortiGate reaches the internet through a proxy, use:
execute vm-license <license_token> <proxy>
Only run this if you have a genuine FortiFlex token (for example, from an E2E migration email) and E2E support has directed you to use it. Injecting an incorrect or unrelated token can put your firewall's licensing into an unexpected state. If you're unsure, raise a support ticket instead — do not guess at a token value.
For the complete, version-specific syntax (including retry-timing options), see Fortinet's own documentation: Inject a FortiFlex license with the CLI.
My firewall is stuck in "Upgrading" status. What should I do?
Wait — the upgrade must fully complete before the firewall returns to Running. Do not power on the firewall manually while it shows Upgrading, and do not start a second upgrade (the portal blocks a second upgrade while one is already in progress, so retrying won't help and could confuse the status further). If the status doesn't change after a reasonable wait, raise a support ticket with your firewall name and the time you started the upgrade.
Related Resources
| Resource | Use it for |
|---|---|
| Upgrade Firewall Plan | Step-by-step upgrade instructions |
| Licensing and Security Subscriptions | How FortiFlex licensing works, and licensing-specific troubleshooting |
| Firewall Action Availability | Why an action might be hidden, disabled, or rejected |