What Happens When a FortiGate License Expires?
When a FortiGate license expires, the device keeps running as a basic firewall, NAT, and VPN; but FortiGuard services (IPS, antivirus, web filtering, sandbox) stop, leaving the device unprotected against new threats. When FortiCare expires, you lose support, firmware, and RMA access.
What Exactly Changes at Expiry?
At expiry firewall policies, NAT, and VPN keep working; but services tied to up-to-date threat intelligence (IPS signatures, antivirus, web and DNS filtering) stop updating and become progressively ineffective.
FortiGate continues passing traffic as a stateful firewall even unlicensed. So connectivity is not cut entirely; but this is misleading, because the device's 'security' value largely comes from FortiGuard services.
When antivirus and IPS signatures cannot update, protection against new malware and attacks weakens quickly. Web and DNS filtering categories also age, so policies may not work as expected.
To renew quickly, see our FortiGate license renewal steps article, and for the overall process our comprehensive license renewal guide.
Different Impacts of FortiGuard vs FortiCare Expiry
FortiGuard expiry stops security services; FortiCare expiry removes support, firmware access, and hardware replacement (RMA) rights. Their impacts differ and should be assessed separately.
FortiGuard is the security subscription: when it expires, services like IPS, antivirus, web/DNS filtering, and sandbox cannot stay current. FortiCare is the support and maintenance contract: when it expires, you cannot get technical support, access firmware updates, or replace faulty hardware via RMA.
| Subscription | Impact at expiry |
|---|---|
| FortiGuard | IPS, antivirus, web/DNS filtering, sandbox stop |
| FortiCare | Technical support, firmware access, and RMA lost |
We examine the distinction in our FortiCare vs FortiGuard renewal differences article.
What Is the 2-Day Grace Period?
The grace period is a 2-day buffer FortiGate adds to the official expiry date; it gives administrators who miss the renewal date a chance to adjust services and avoid an abrupt outage.
The grace period is not permanent protection; it is just a short breathing space. Within it, you should renew the license or adjust services in a controlled way. At the end, the relevant FortiGuard services are disabled.
Relying on the grace period to delay renewal is risky; also, due to the continuity model, the lapse period can be charged retroactively at renewal.
The Risks That Arise
The risks of expiry can be summarized as exposure to new threats, compliance violations, lack of support, and a prolonged outage if hardware fails.
An IPS/antivirus that cannot receive current signatures becomes progressively ineffective against zero-day and new threats. In many sectors, up-to-date security controls are a compliance requirement; expiry can violate them.
Find likely technical issues and fixes in our renewal problems and solutions guide, and verifying the device's current state in our license status check article.
What to Do If the License Has Expired
If the license has expired, first verify the state, obtain and activate a renewal contract as soon as possible, and ideally remove backdating risk with a multi-year contract.
- Check the device's license status and identify which services expired.
- Obtain a suitable-term renewal contract from a partner.
- Register the renewal/activation code on the support portal and sync the device.
- Verify that services are active again.
- Set up a renewal reminder or automation to prevent recurrence.
To prevent recurring misses, see our renewal automation and reminders article.
Frequently Asked Questions
Does internet go down when the license expires?
No. FortiGate keeps passing traffic as a basic firewall, NAT, and VPN; connectivity is not cut. But FortiGuard services like IPS, antivirus, and web filtering stop.
Which services stop?
When FortiGuard expires, IPS signatures, antivirus, web and DNS filtering categories, and sandbox stop updating and become ineffective over time.
What does FortiCare expiry mean?
When FortiCare expires you cannot get technical support, access firmware updates, or replace faulty hardware via RMA. This risks an unsupported outage if hardware fails.
Does the grace period protect me?
The grace period is only a short 2-day buffer and provides no permanent protection. You should renew within it; otherwise services are disabled.
Do I pay retroactively if I renew an expired license?
Because FortiGuard is designed as a continuous service, the lapse period can be charged via back-coverage at renewal. Backdating is capped at 6 months.
Can I renew after the license has expired?
Yes, you can renew after expiry; but due to the continuity model, an additional charge spanning the lapse and a security risk may arise. It is best to renew before expiry.
Conclusion
When a FortiGate license expires, the device keeps working but most of its security value is lost: IPS, antivirus, and filtering stop, and with FortiCare, support and RMA rights end. The 2-day grace period is only a short buffer.
To quickly renew expired or soon-to-expire licenses, talk to the Sora Yazılım team.