New Member

Question

From CISCO to FORTIGATE

Forum|Forum|11 years ago
November 4, 2014
8 replies
34573 views

Hello to the FORTIGATE community

As the title says, I am in the middle of a project that consist of moving from CISCO to FORTIGATE. I am new to routing world and I have been learning lots of new things... Can someone help me do this? I am willing to provide any information needed like all the configuration that my CISCO have right now. If someone knows about the two systems and is willing to help please PM me. Thanks.

Courtney_Schwartz

Staff

FortiConverter can do this for you.

http://www.fortinet.com/p...ticonverter/index.html

emnoc

New Member

Yeah forticonverter sounds good but what are you migrating from and too?

pix

asa

security-router

to a cluster fortigate?

NOTE: If you don't have experience you should contract with a fortinet partner or consultant. professional services could be offer to easily lift and move from vendor XYZ to Fortinet

CentrocitoAuthor

New Member

emnoc wrote:
Yeah forticonverter sounds good but what are you migrating from and too?

pix
asa
security-router

to a cluster fortigate?

NOTE: If you don't have experience you should contract with a fortinet partner or consultant. professional services could be offer to easily lift and move from vendor XYZ to Fortinet

I checked the forticonverter but it will convert all the old configurations that I dont really need.

I am moving from a Cisco 2801 to a 100D

And yeah it seems I am going to need to pay anyway.

Courtney_Schwartz

Staff

Centrocito wrote:

I checked the forticonverter but it will convert all the old configurations that I dont really need.

You can tell FortiConverter to remove unused objects. That's one of the reasons it gives cleaner results than migrating manually.

FortiConverter was designed, among other things, to accelerate professional services.

emnoc

New Member

Than take out the cfg that's not relevent or that you don't need. What I would do if your moving from let's say a pix or asa, define your L3 interfaces or if transparent mode, define your 2 in/out interfaces 1st.

Than do all firewall address ( objects in cisco lingo ) and then do any firewall polices

lastly, the vpn and other misc.

Dump all of the polices and do a audit b4 and after and you might find you have to clean up a few items. A <50 line or less PIX or ASA is nothing. A 51-1000 line fwpolicy pix/asa might be more challenging but still is not to hard. When you get into >1001 than that could become stressful.

bartman10

New Member

It's not hard.. I'm converting from ASA5510's and 5505's to FG.. The best advice I can give you is a Fortigate calls a NAT, a VIP. Virtual IP. Why I have no idea..

Also in the cookbook I read when deploying it for the first them the example they give you for doing a VIP(NAT) they combine the VIP and PAT into the same statement! If you follow this you'll need a VIP statement for every freeken port on a server. This would be fine if the server only has 1 port.. but my god WHY!..

Just leave the port part empty and control it like normal in the firewall rule.

Best part of a FG is the "show" and "get" command when you are in a subsection of the CLI.. I"ve always wanted to know why Cisco can't do something like this!

Courtney_Schwartz

Staff

bartman10, on Cisco, are you aware of "do show running-config" etc. when within the "en / conf t" scope? Basically use your typical command, but insert "do" in front of it to be able to execute the command while in a configure shell.

IMO, it's not as nice as Fortinet's "show" and "get" ... But may help you if you have a mixed environment.

emnoc

New Member

Best part of a FG is the "show" and "get" command when you are in a subsection of the CLI.. I"ve always wanted to know why Cisco can't do something like this!

And the cisco ASA and PIX both has had show commands for sections within the enable or config mode

E.g

show run access-list ( will display acl i.e could be your firewall policies )

show run crypto ( show vpn details )

show run tunnel-group ( vpn peers )

show run dhcpd ( dhcp servers)

IOS-XR would be the most similar with show within the configuration mode and sections. So yes cisco ASA OSes it's not " fortiOS", but it's cisco and it good & simple for those who has experience within. Show commands in cisco ASA are very similar built to a fortigate show/get in some places and areas it's better.

e.g

IOS show redirection and matches vrs the fortinet limited "grep"

btw; JunOS is also similar to FortiOS with show commands with the additions of display set and match options. As a matter of factor it's better than cisco and even Fortinet imho and experience.