Technical Tip: How to move Policy Package with Policy Block to new FortiManager

[jkubesa]

Description	This article describes the process of copying a policy package containing one or more policy blocks from one FortiManager to another.
Scope	FortiManager.
Solution	Review the policy package on existing FortiManager, it may look similar to the following example, containing a policy block with 1 policy: Run the following command: execute fmpolicy print-adom-policyblock ? After, follow the options to select the corresponding ADOM, policy block and all relevant policy types. Additionally, print the general settings. Optionally use the following command to print the content of the policy package that contains the policy block: execute fmpolicy print-adom-package ? Note that the policy block is referenced using the ID of the object. On the destination FortiManager, create an empty policy block. Under Device Manager-Scripts create a new Script, select Run Script On Policy Package or Device database. Paste the contents of the policy block print from the source FortiManager as script content. Run the script on the target policy block. If the steps were followed correctly, script will execute and contents of the policy block will be the same on both FortiManager devices. To assign the policy block to corresponding packages, this can be done manually from the GUI or if step 3 was followed, a script can be prepared and executed against the policy package referencing the policy block: Note: Because the policy block is referenced in the policy package by ID only, it is necessary to reference the policy block ID on the destination FortiManager. In this example, the old ID was 6066 and the new ID is 6061, A list of policy block IDs can be obtained by using the following command: execute fmpolicy print-adom-policyblock ? After executing the second script against the policy package, verify that the content of the policy package on the source and destination FortiManager is identical.