Technical Tip: Migrate config to a different model FortiGate using FortiManager

Migrating config involves 2 parts: device settings (including all the templates) and policy package.

1. Migration of Device Settings.

In this article, copy over device-level settings by capturing the configuration in provisioning templates (this applies to System Settings, SDWAN, Static Routes, BGP, and IPSec Tunnels): Device Manager -> Provisioning Templates -> Select the template type -> More -> Import.

Note: Another approach to migrate device settings is to use FortiConverter, as discussed in Technical Tip: How to replace FortiGate with a different model in FortiManager.

This step will import all IPsec tunnels from the old device and save their configurations as a template.

Then select the old device from the drop-down list:

Any required changes, such as 'Outgoing Interface', can be applied before assigning the template to the new FortiGate. Same steps apply for other types of templates (i.e., BGP template, SD-WAN template, etc).

Notes:

• Interfaces (VLANs, zones, ...) will not be imported by these templates; the interfaces must be manually created either in Device Manager GUI or via a script that runs against the Device Manager.
• Check any templates assigned to the old FortiGate that may be needed for the new and assign those.

2. Policy & Objects.

The Policy Package of the old FortiGate can be assigned to the new FortiGate by modifying the 'Installation Targets' in the Policy Package.

Interfaces used in the Policies are the 'Normalized Interfaces' that need to be mapped to the physical interfaces.

Below is an example of a Normalized interface 'Data', it needs to be mapped to the device interface on the new FortiGate via per-device mapping or per-platform mapping.

Once all the templates and policy package are ready, perform the install in steps.

1. Install only device settings first, so all the interfaces are created.
2. Install Policy Package after confirming the normalized interface mappings are correct.