VPN Configuration from 100D to another 100D

Question

I want to migrate only VPN Tunnels created at Fortinet 100D(Device1) to Fortinet 100D(Device2). Both are exactly the same.

I dont want any other configuration to migrate, only VPN data, so when i get the same ip address advertised at Device2, all VPNs are up and running.

Kindly share, if there is any tutorial regarding this in Fortinet Cookbook or any way to achieve it.

Note: Some tunnels are also route based, if that matters anyway.

Toshi_Esumi · Answer

I don't think any documentation for your particular scenario of migration.

But if the number of tunnels are not too small to just create them from scratch on the new 100D, I would copy the config via CLI for below:

[ol]

copy phase1-interfaces under "config vpn ipsec phase1-interface"

copy phase2-interfaces under "config vpn ipsec phase2-interface"

copy only the difference of interface config created by those phase1-interfaces under "config system interface". you might need to modify some like internet interface name. Never copy snmp-index, which is generated automatically at the new box.

copy zones if those vpn interfaces are bound in some zones

copy or create policies involving the vpn interfaces and/or zones

finally copy static routes if anything bound to the VPNs exists.[/ol]

I think that's all. Bottom line is you have to understand what part of config is involved in IPSec VPNs to work and what part need to be modified to fit at the new box.

Sign up

Login with SSO

Login to the community

Login with SSO