Migrate Checkpoint firewall to new Fortinet firewall

So you want to stand up 2x side-by-side firewalls?

That can be done and with intra-vlan traffic it should work. But you might have to add intra-links to route from lans on fgt to chkp if required. 1st item; Do you have a new set up public-address on the wan side for the FGT

What I would also do is audit the global-nat table and objects since these can be tricky when you have side-by-side firewalls and especially when you have numerous DNAT rules and no additional public-subnets. So have you audited all objects in the CHKP including any vpncommnunities ?

Q1: Why can't you use the FortiGate converter and convert the chkp stuff to ftnt? IMHO if you have less than 200 rule I would not even buy the converter but just audit the CHKP stuff and recreate new host/network objects , VPN,nat rules, and at the same time this is a good time to monitor policy-count on each policy that you are migrating. The last time we migrated a chkp to FortiGate I removed over 100 unused or duplicate rules/objects. The converter does a pretty good job but you will have some items that will need fixing and object-nat are the biggest items to pay attention with. Once you have  a successful convert see Q2 below

Q2: Can you take a 2-4 hour maintenance-window and just do a hot cut? If you successfully audit the objects in CHKP and recreate them into FortiOS, you only might need to pull a few cables and flip a few switchports. The beauty here , you do the cutover and be done, or if something does not work, you rollback. Running side-by-side firewall can be problematic if your network is complex. It works  great when you have internal layer3 routing for local LANs but if you have gateways on the security-devices issues such as routing, etc......can become problematic at the end of the day

Q3: Are your CPSG doing any IDS or policy?

Q4: If you go with side-by-side ( FGT + CHKP ) you can maybe start with generic internal traffic to the internet and add or peel off web/sql or other applications network if your networks separated. Is that something your planning on doing?

just my few thoughts on the matter 

Ken Felix