Skip to main content
johnlloyd_13
johnlloyd_13
Explorer III
January 10, 2025
Question

Migrate Cisco ASA to Fortigate

  • January 10, 2025
  • 2 replies
  • 3163 views

hi,

i'll be refreshing HW and will migrate our cisco ASA to FGT.

my questions are:

 

1.our ASA environment is a context-based/multi-tenant FW, so when i create a new VDOM, do i always choose "central NAT" since it's closer on how ASA is implemented?

 

2.we have an ASA context solely used for IPSec VPN. do i also choose "central NAT" in this scenario?

 

3.can i create a new VDOM directly on the FGT device or is it best practice to do it via FMG?

 

4.i'll be ordering a forticonverter license to help with my ASA migration. is the result/conversion 100% accurate? or do i still need to manually inspect the output/config?

 

5.after i converted the ASA context/config in forticonverter, how do i apply the config on a FGT? do i apply the config directly on the FGT device? or via FMG?

 

apologies for all these questions since it will be my first time converting ASA to FGT.

looking forward to your reply. thanks in advance!

 

2 replies

Anthony_E
Staff
Anthony_E
Staff
January 13, 2025

Hello John,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Best Regards
AEK
SuperUser
AEK
SuperUser
January 13, 2025

Hi John

 

If ASA uses central SNAT then it is easier to migrate the NAT policy when you set your FGT to central SNAT as well. But you can still use central NAT or in-policy-NAT following your preference. Same for IPsec related question (Q2).

 

Fort VDOM creation, if your FGT unmanaged then you create directly from FGT (you don't have choice here), but in case it is managed by FMG then the more correct way is to create it from FMG.

 

As per my experience, the FortiConverter usually doesn't convert the config at 100%, so you usually need to do some manual job to complete the conversion. But is seems the FortiConverter cloud service converts much better than the tool, since there are Fortinet engineers that help you converting your config.

https://docs.fortinet.com/document/forticonverter/7.2.0/online-help/220359/supported-versions-and-conversions

https://docs.fortinet.com/document/forticonverter-service/23.1.0/online-help/765339/3rd-party-security-vendors-conversion

So in general rule, if you have a single conversion, and you don't have enterprise subscription, then it is better to order FConv cloud service (better and more complete conversion, but I can't confirm if it is 100%), otherwise in case you have multiple conversion to perform during this year then it is probably more interesting (in terms of price) to order FConv tool subscription.

 

As it is a fresh conversion, I'd apply the config directly to the FGT (before connecting to FMG), then I'd integrate the FGT with the FMG.

AEK
    johnlloyd_13
    johnlloyd_13Author
    Explorer III
    January 17, 2025

    hi,

    thanks for these insights! unfortunately, our team has decided to go with policy-based FW rules/NAT (not central NAT).

    by going this path, we can familiarize ourselves with FGT config/setup and move away from ASA mindset/tech.

    i agree to do a hybrid job, i.e. use foritconverter and audit/config manually by hand since output is not always perfect.

    since FGT is already added to FMG, i plan to apply the converted config separately: the interfaces, routes will be applied direct to the FGT, then it will auto update to FMG. the other part which is the address object, FW rules will be applied to FMG, will this plan work and a good idea?

     

    AEK
    SuperUser
    AEK
    SuperUser
    January 17, 2025

    Yes you can do that as well.

    AEK
    Terms & ConditionsAccessibility statement