Licensing

FireSight is licensed by the number of firewalls it manages. A license is a small signed text file (.lic) from the FireSight customer portal, issued for one FireSight system. FireSight checks the file's signature itself, so licensing works in isolated (air-gapped) networks; online renewal is optional.

Administrators manage the license under Settings, License.

What counts as a firewall

Each physical or virtual firewall that FireSight manages through a live connection counts once.

Counts	Doesn't count
Each FortiGate, physical or virtual (VM)	Managers, such as FortiManager
An HA cluster, once (FortiManager lists it as one device)	Virtual domains (VDOMs) and virtual systems: they belong to the firewall they run on
	Firewalls in offline snapshots
	The built-in demo firewalls
	Firewalls marked Removed from FortiManager

The same firewall reached through two connections (for example through FortiManager and directly) counts once. Settings, License shows Firewalls in use against the number licensed.

Evaluation

Without a license, FireSight runs as an evaluation:

30 days, starting when the system is installed;
up to 10 firewalls;
everything works.

In the last seven days, administrators see a banner: The evaluation ends on …. Install a license to keep deploying.

License states

State (shown as)	When	Effect
Evaluation	No license, within 30 days, up to 10 firewalls	Everything works.
Licensed	A valid license, within its dates and firewall count	Everything works. Check Valid on the License tab for the end date, and renew before it.
Grace period	More firewalls in use than licensed, the license expired, the evaluation is over 10 firewalls, or the hardware no longer matches, for less than 30 days	Everything works. A banner on every page shows the date new deployments stop.
Deployments stopped	The 30 days of grace are over, or the evaluation ended	New deployments are refused until a valid license is installed.

What "deployments stopped" means

Only new deployments stop. A deployment is refused with New deployments are stopped by the FireSight license. An administrator can renew it under Settings, License, or at https://portal.firesightsystems.com.

Everything else keeps working, so a lapsed license never stops anyone undoing a change:

back-out, including automatic expiry of temporary rules;
rule requests, approvals and reviews;
sync, audits, findings and reports;
device health, the audit log and every setting.

Banners

Grace period: every user sees The FireSight license needs attention. Deployments stop on … unless an administrator renews it.
Deployments stopped: every user sees New deployments are stopped by the FireSight license. An administrator can renew it under Settings, License.

Administrators see a License settings link in the banner. Other people see only the state and dates, never the customer, the counts or the details.

The License tab

This installation

Field	Shows
Status	Licensed, Evaluation, Grace period or Deployments stopped, with a message when it isn't licensed.
Firewalls in use	In use, and how many are licensed (or (evaluation)).
Customer, License, Valid	From the installed license: the customer name, license ID, edition, bound to this installation, and its start and end.
Renewal	A renewal installed early, with its firewall count and dates.
Deployments stop	The date new deployments will stop, during an evaluation or grace period.
System serial	This system's serial number, such as `FS-XXXX-XXXX-XXXX`.
Installation ID	This installation's permanent ID.
Hardware	Shown only when the hardware no longer matches the license.

If an installed license can't be used, the tab says The uploaded license can't be used: and why.

The system serial

Every installation has a permanent installation ID, created on its first start and kept in its database, and a short system serial derived from it. A license is issued for one serial and never works on another system. Quote the serial when you contact support.

License a system

In FireSight, open Settings, License, and under Activate this system click Download activation request. It saves firesight-<serial>.req.
Sign in to the customer portal and upload it under Register a system. See Register a system and get a license.
Ask for a license on the system's page (or your reseller issues one). You get an email when it's ready.
Download the .lic file from the portal (Download .lic).
In FireSight, under Install a license file, choose the file in License file and click Install license.

The activation request is encrypted for the portal. It holds this system's serial number, a hardware fingerprint (hashes only, never the values), the FireSight version, the number of firewalls in use, the host name and the current license ID. No firewall configuration or traffic is ever sent.

Installing checks the file's signature on this system; nothing is sent anywhere. Each installation and removal is recorded in the audit log.

Remove a license

Remove license (shown when a license is installed) asks for confirmation, then removes it. FireSight goes back to evaluation, or stops new deployments if the evaluation is over.

Renew

By file: ask for a renewal on the portal, download the new .lic and install it the same way. A newer file for the same license replaces the old one.
Renewals installed early wait for their start date. The current license stays in force until then, and Renewal shows when the new one takes over.
More firewalls: ask for More firewalls on the portal, then install the new file.

Online renewal

Under Online renewal, tick Renew the license automatically from license.firesightsystems.com once a day. It is off by default and needs an installed license.

When on, FireSight sends only the license ID, this installation's ID, the number of firewalls in use and the FireSight version, and installs the current license file the server returns. Renew now checks straight away. The tab shows the last attempt and its result. A failed renewal never blocks anything.

Leave it off in isolated networks and install renewed files by hand. The FireSight server needs outbound HTTPS to license.firesightsystems.com for it.

Moving to new hardware

A license is tied to the system's hardware fingerprint as well as its serial. If you restore or move FireSight onto new hardware, the tab shows Hardware: Doesn't match the license: request a re-host on the portal, and the license keeps working for 30 days.

To re-host:

In FireSight on the new hardware, click Download activation request.
On the portal, open the system and upload it under Moved to new hardware? with Upload and request re-host.
Install the new .lic file when it's ready.

The system clock

Changing the system clock doesn't extend an evaluation, a grace period or a license.

License messages

Message	What to do
this isn't a FireSight license file / the license file is damaged	Download the `.lic` file again from the portal and upload it unchanged.
that's far too large to be a license file	You chose the wrong file.
this license wasn't issued by FireSight (unknown signing key)	The license was signed with a key this FireSight release doesn't trust. Upgrade FireSight, or contact support.
the license signature doesn't match: the file was changed or isn't genuine	Download it again; don't edit it.
this license belongs to a different FireSight installation / this license is for system …, not this one	The license is for another system. Check the serial on the portal.
this license isn't tied to an installation	Download the license from the portal for this system's serial.
this is an older copy of a license already installed here	Download the latest file from the portal.
the license only starts on …	The license isn't valid yet. Nothing to do: it takes effect on its start date. Until then the evaluation applies.
the license ends before it starts	Contact support.
This system's hardware no longer matches its license	See Moving to new hardware.
Renewal refused: … / Couldn't reach https://license.firesightsystems.com	Online renewal failed. Check outbound HTTPS, or renew by file.

For Download failed on the activation request, see Troubleshooting.