The FortiGate grace period, without the wishful thinking
"There's a grace period, right?" — the most hopeful question in firewall licensing. Sort of. Here's what the buffer actually covers, the day-by-day of what stops when, and the back-dating rule that makes waiting pointless anyway.
Three different things people mean by "grace period"
"Updates keep flowing for a bit after expiry." True — briefly. There's a short buffer, on the order of a couple of days, where FortiGuard services typically keep updating while a renewal registers. It's designed to absorb procurement paperwork, not to give you a free week.
"The firewall keeps working." True indefinitely — and misleading. Traffic flows, policies enforce, VPNs stay up. That's exactly why lapses go unnoticed for months: nothing visibly breaks while the protection quietly ages.
"I can renew later without losing anything." False. This is where the back-dating rule bites — see below.
The honest timeline after expiry
Day 0 — expiry. Nothing visible happens. Every service still runs.
Days 1–2 — the real grace window. Updates typically continue in a short buffer. If your renewal was ordered and is registering, you'll likely never see a gap.
After the buffer. IPS signatures, antivirus definitions, web-filter categories and antispam freeze. The features keep running against an ageing database — protection theatre that thins by the week.
From expiry, immediately: no FortiCare — no Fortinet TAC support, no advanced hardware replacement if the unit dies.
On current FortiOS (7.4.2+): firmware upgrades are blocked without an active contract — you're pinned to your current release, including its known vulnerabilities.
A renewal bought after expiry doesn't start when you pay — under Fortinet's continuous-service rule it's back-dated to the expiry date. Lapse three months on a 12-month renewal and you get nine months of forward cover. The gap gets paid for either way, so the "grace period" strategy of coasting unlicensed has a guaranteed cost of exactly zero savings, plus the risk you carried while coasting. Long lapses can also attract reinstatement handling, which we show explicitly on quotes for lapsed devices.
What to actually do
Expiring soon:renew now — the new term starts when the old one ends, nothing is lost by being early. (Our clients get reminders before expiry precisely so this page becomes irrelevant to them.)
Already lapsed: still fixable, back-dated, options quoted. Months-long lapse on an ageing unit? Read renew vs upgrade first — sometimes the smarter rand goes to a new box.
Two minutes now beats two days of grace later
Serial in, rand quote out — TechCo ICT handles the rest, end to end.