Licence renewal · Fortinet partner
When a FortiGate subscription lapses, the firewall carries on forwarding packets exactly as before. Traffic flows, dashboards stay green, and no alert fires. What has actually stopped is the flow of new threat intelligence — so the box is now enforcing last year’s understanding of the internet, and will keep doing so indefinitely until somebody notices.
FortiCare · UTP · ATP · FortiGuard services · renewal on hardware bought anywhere
The failure mode
Why a lapse is quiet
No alert fires on the day a subscription lapses.
Most operational failures announce themselves. A subscription lapse is one of the few that does the opposite: the device degrades into a router with opinions, and every monitoring system you own reports that it is fine. The cost is not incurred on the expiry date — it is incurred on the first day something new arrives that the box no longer recognises.
FortiCare and the bundles
What renews, and when
The common and expensive surprise is that the support entitlement and the security services are separate things with separate dates. An estate can hold valid support and no threat intelligence, or the reverse.
| Entitlement | What it gives you | What lapsing costs |
|---|---|---|
| FortiCare | Technical support, firmware access and hardware replacement entitlement. | No RMA path and no firmware — discovered during an incident |
| Security bundle (UTP / ATP) | Antivirus, IPS, web and DNS filtering, application control and the associated FortiGuard feeds. | The device stops learning; nothing visibly changes |
| Registration account | Where the serial number lives and who can act on it. | If it is a former supplier’s account, everything above ends with that relationship |
Scroll the table sideways on a narrow screen.
We renew against serial numbers regardless of who originally supplied the hardware, and we will tell you what is genuinely registered against each serial before you commit — which is occasionally a different picture from the one on the purchase order.
Why lapses happen
The renewal calendar nobody owns
Subscription expiry is a diary problem that turns into a security problem, and it slips for a structural reason: the person who bought the entitlement three years ago has usually moved on, and the person now responsible for the firewall was never told a date existed.
Two dates, not one
Support and security services expire independently. An estate can hold current FortiCare and dead FortiGuard feeds, which looks entirely healthy from the support portal and is the worse of the two failures.
The dates drift apart
Hardware bought at different times, renewed for different terms, co-terminated once and then not again. A large estate tends toward a scatter of dates rather than one, and each one is an opportunity to miss.
Renewal is not automatic
Nothing renews itself. There is no failed payment, no service interruption and no warning banner in the path of anyone who would act on it. The lapse is silent by design.
The registration account outlives the relationship
Entitlements bought through a previous supplier can sit in that supplier’s account. Moving them is a process with paperwork, and it is considerably easier to start before you need it urgently.
The check
What we check against each serial
What is actually registered
The entitlements genuinely attached to the serial number, which is occasionally a different list from the one on the original purchase order.
Both expiry dates
Support and security bundle, reported separately, because they are separately purchased and separately fatal.
Whose account holds it
Named, so you know whether your entitlement survives a change of supplier.
Hardware lifecycle
Whether the platform is approaching end-of-support, because renewing a subscription on a box the vendor is about to retire is money spent on a shortening runway.
Co-termination options
Whether scattered dates can be pulled onto one renewal cycle, which usually costs a little once and saves the diary problem permanently.
Right-sizing the bundle
Whether the services you are renewing are the services you are using. Estates frequently renew bundles that include features nobody has ever enabled.
Questions
Licence renewal, answered
What happens when a FortiGate subscription expires?
The firewall keeps forwarding traffic, which is precisely the problem. What stops is the part that makes it a security device: signature and threat-intelligence updates, web and DNS filtering categorisation, and sandbox submission. Nothing alarms, nothing fails over, and the estate looks healthy on every dashboard while quietly ageing out of relevance.
Whose account are our subscriptions registered in?
Worth checking today rather than at renewal. Entitlements register against a serial number in a specific account. If that account belongs to a previous supplier, your threat intelligence, filtering and support entitlement end when that relationship does — and moving them is a process, not a switch.
Can you renew subscriptions on hardware bought elsewhere?
Yes. Renewal is tied to the serial number, not to who originally sold the box. We will ask for the serials and current expiry dates and come back with what is actually registered against them, which is occasionally not what the customer believed.
What is the difference between FortiCare and UTP?
FortiCare is the support entitlement — firmware access, hardware replacement and technical support. The bundles such as UTP add the security services: antivirus, IPS, web filtering, application control and similar. They can expire on different dates, which is a common and expensive surprise.
Can we renew after the subscription has already lapsed?
Usually, though a lapse can carry back-dated charges and there may be a gap in entitlement that cannot be retrospectively filled. The commercial answer depends on how long it has been lapsed. Send the serial and we will tell you where you stand before you commit to anything.
Do you track expiry dates for customers?
Yes, for estates we maintain, and it is one of the more valuable and least glamorous parts of an AMC. Expiry tracking is a calendar problem that becomes a security problem roughly one day after everyone stops thinking about it.
Next step
Send the serials, get the real picture
Give us the serial numbers and we will come back with what is actually registered, what expires when, and whose account it sits in. No obligation attaches to finding out.