FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes the process of migrating the configuration file between identical FortiGate models.
Scope
FortiGate.
Solution
Make sure that both FortiGates are the same model, as configuration migration between different FortiGates is supported only through FortiConverter services.
It is recommended to have local access to the firewall via a console cable. However, this task can also be performed using remote management access. Console access is the preferred method.
Take a configuration backup using either the GUI or CLI. For encrypted backups, a password is required to restore the configuration on the new device. Configuration backups and reset.
If VDOMs are enabled on the old FortiGate:
The new FortiGate must have the appropriate license if more than 10 VDOMs are needed, as most FortiGate models support only up to 10 VDOMs by default.
To check the maximum number of VDOMs supported on the current FortiGate, use the command:
get system status | grep Max
If the configuration migration is performed remotely:
Make note of the management IP/Mask to regain remote access to the firewall.
Ensure that the computer/Laptop has access to the management IP
If any local-in policies or trusted hosts are configured for admin management access:
Ensure the connecting computer is on the same IP/subnet listed in the trusted host settings. Otherwise, GUI/SSH access will not be established.
Confirm that the management interface status is up.
If multifactor authentication (MFA) is configured for firewall admin users:
It should be removed from the configuration before migration.
FortiTokens are tied to a FortiGate's serial number, and FortiTokens from the old device will not work on the new one.
For restoring the configuration in an HA (High Availability) cluster environment, use the following methods:
Scenario 1: Configuration migration to Primary and Secondary units from the previous standalone unit
Keep both cluster units separate and do not connect the network and HA cables to the secondary unit.
Restore the configuration file on the primary unit.
Edit the config file to:
Change the hostname
Modify the HA priority and override settings (Override should only be enabled on the unit you want always to become primary. The priority value on that unit should be higher compared to the secondary unit).
Restore the config file on the secondary unit through a GUI or CLI
