Skip to main content
aes128cbc
aes128cbc
New Member
June 2, 2019
Question

Upgrade Fortigate Hardware, but keep Fortiswitch config?

  • June 2, 2019
  • 1 reply
  • 3121 views
Hi all, Just as the title says: we're replacing our 300D with a 300E cluster (both on 6.0.4). There wasn't an easy way to transfer the existing config, so I spent a couple hours and recreated it all from scratch (cutting out a lot of legacy items in the process: objects, policies, etc). I know this was probably a dumb move, but the old config was a huge mess and it was badly needed anyway. In my newbie wisdom, I forgot about the carefully crafted Fortiswitch topology that the 300D has in its config, along with all of the vlan/port assignments. There are 16 switches that will remain in production (currently in this configuration), and I don't want them to change. How can I transfer this to the new 300E easily?

Copy + paste from one config to another?

We just setup FortiManager as well, and I feel like it should make this kind of process easy, but can't find any import/export option. I can see the switches and APs in FMG, but don't see a way to "apply" them to a different fortigate.

Any advice would be greatly appreciated!

1 reply

sw2090
SuperUser
sw2090
SuperUser
June 3, 2019

FMG is rather useless here as switch config is part of the device config and not of the policy package.

Since the dievce config is device specific there is no way to roll that out to annother FGT. 

Except if you replace that FGT in FMG by a new one and the roll out device config and policy package to it.

Thus this may still require a load of work since - if the FGTs are too different - you may have to correct a lot of interface mappings....

 

Anyhow I cannot imagine that a 300D and 300E are so very different. As long as they have the same INterface layout and names you should be able to copy paste most of the config (execpt from clustering).

I'd in this case try to create a backup, maybe replace the serial number in it to fit the new FGT and then apply it to the new one. Or if that don't work apply it as a script.

aes128cbc
aes128cbcAuthor
New Member
June 4, 2019

I ended up copy+pasting sections of the old config over to the new one. I used find/replace to change the updated interface names. It worked perfectly!

Terms & ConditionsAccessibility statement