Skip to main content
Cajuntank
Cajuntank
Contributor III
January 28, 2023
Solved

Legacy WAN migration to SD-WAN?

  • January 28, 2023
  • 3 replies
  • 11014 views

My setup is that of your traditional legacy WAN hub (data center) and spoke (branch sites). Currently, my only Internet access is at my data center. Even though they are on private WAN connections, the branch locations' connection to the WAN is via FortiGate (for traffic inspection purposes away from the data center).

 

I am in the process of adding Internet connectivity to each of these branch sites (will also add secondary Internet connectivity at the data center as well in the near future). I have a fair grasp of what needs to be done and following the hub/spoke guidelines in the SD-WAN Branch Deployment Guide documentation; however, what I am missing is process/procedures or caveats in migrating an existing used interface over to a new zone. So what I mean is, if I have my existing interface in a WAN zone and policies are applied to that zone, will I be able to easily move that interface to the new SD-WAN zone? I know I cannot do anything with the interface while it references something, so I know I have to deal with these things, but I am just trying to make sure I am thinking of everything and have "all my i's dotted and t's crossed" as it were. I know once I move my interface, I will have to change all of my policies to reflect to the new SD-WAN zone.

 

Hoping someone that has done this can chime in and give some additional thoughts or guidance in case I am missing something.

Best answer by gfleming

You can use the Interface Migration Wizard to assist you here: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/885870/interface-migration-wizard

 

I would definitely suggest testing this during a maintenance window to ensure everything works as expected. But this should take most of the headaches and pain away when moving from legacy to SD-WAN configuration on your existing FortiGates.

3 replies

AEK
SuperUser
AEK
SuperUser
January 30, 2023

Hello

First, it doesn't matter if you fail the first and second try but the most important is to have a quick, clear and valid rollback procedure.

Try prepare your interface migration (the whole procedure or some) by CLI commands in a text file. Then just run it on CLI script when you want to migrate.

Here is a overall scenario:

  1. Make a backup of your system FGT config
  2. Create a SD-WAN interface with a dummy interface (unused)
  3. In your CLI text file, for every policy ID that is using the physical WAN interface, replace this interface with SD-WAN interface name. E.g. :
    config firewall policy
      edit 4
        set dstif sd-wan
    ...
  4. Run the script on your FGT in one shot
  5. Delete the default gateway (usually it is the WAN interface)
  6. The old physical WAN interface is not used anymore, so you can encapsulate it in your SD-WAN interface, and remove the dummy interface
  7. Add a default gateway using the SD-WAN interface
  8. Test
  9. If it doesnt wotj then you have time to troubleshoot until the end of your maintenance window
  10. If time is up then execute your rollback procedure (e.g.: restore and reboot)

Hope it helps

 

AEK
    gfleming
    Staff
    gflemingAnswer
    Staff
    January 30, 2023

    You can use the Interface Migration Wizard to assist you here: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/885870/interface-migration-wizard

     

    I would definitely suggest testing this during a maintenance window to ensure everything works as expected. But this should take most of the headaches and pain away when moving from legacy to SD-WAN configuration on your existing FortiGates.

      Cajuntank
      CajuntankAuthor
      Contributor III
      January 30, 2023

      OMG, how did I miss this? I confirmed this is also applicable with fortiOS 7.0.9, which is the code rev I am on. I will have to play around with this, but it looks extremely promising. Thanks.

        Cajuntank
        CajuntankAuthor
        Contributor III
        February 1, 2023

        I attempted this today and that worked fairly well. It failed once with something due to the interface being tied to OSPF, then it let me attempt again and the option was to remove it from OSPF, which I did, though when I compared the configs, the OSPF config was the same as before. I had to manually change my policies over to new SD-WAN zone from old zone (did not know if the process would do that automatically too) but all looked and tested good.

        ChrisM589
        ChrisM589
        Explorer
        September 9, 2024

        Need to do this too, however on an older code 6.4.15 which doesnt have the auto update type option.

         

        Is it worth going to the next code revision to get this done ?

         

        I am thinking yes, it is the sensible thing to get to the latest version and also may save a lot of hassle getting upgraded to SD WAN.

         

        Any opinions welcome.

         

        Chris.

        Terms & ConditionsAccessibility statement