Runbook Migration of SAML SSLVPN to IPSEC?

Hi.

Has someone done this smoothly who would be prepared to share their recommendations/runbook/checklist? We ideally want to run them parallel for a short period of time, inject the new VPN Connection into Forticlient on every machine and then have a few users at a time choose the IPSEC VPN.

We also need to upgrade them from a 60F to a 70G and wondering if we should do the upgrade to VPN then the migration to new hardware or the other way around?

Thanks in Advance.