FortiConverter

[tranobago]

I just picked up a 1001F to replace my 1000D and they didn't include any kind of support for migration. Now my engineer is suggesting I get the FortiConverter service to convert my config from the 1000D to the 1001F, but they're quoting my almost $2k to do this. That seems a bit steep.

Are there any other good methods to convert configs from 1 model to the next?

[funkylicious]

One way of doing it would be to just adapt the existing config, in regards to interfaces and such and just recreate them on the new equipment.

I would start by moving all custom/created services/vips/addresses/etc ( make sure you dont have dependencies on the interface that might be different )  from the config onto the new device, then create the new interfaces on the device and the firewall rules.

[mle2802]

Hi @tranobago,

Converting the config is outside of the scope of TAC. However Fortinet has a conversion service that is recommended for this situation and is fully supported.. Please refer to this document for more information https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-load-convert-a-FortiGate-configurat...

Regards,
Minh

[mle2802]

Also just to be clear, converting the config is outside of the scope of TAC. However Fortinet has a conversion service that is recommended for this situation and is fully supported.

[dbu]

If you have a valid support contract you can raise a ticket and the support will convert it for you.  

[cvincent_FTNT]

This is actually not correct as TAC does not do conversions.
It is recommended to use the conversion service.

[jtravlos]

The FortiConverter is available as a standalone windows application. You should be able to get an evaluation copy and license for it.  I would suggest trying that.

https://www.fortinet.com/support/product-downloads

[Debbie_FTNT]

To expand a bit on funkylicious:

- the configuration backup is essentially just a CLI configuration dump

- you can copy/paste large parts without any issue (if you're on roughly the same firmware release), as much of the configuration is device-agnostic

-> interface settings and hardware-related settings might need some wrangling, as devices might have different interface names/different numbers of interfaces

One very rough way would be to get the 1000D config file and a default 1001F config file.

Then take the first two lines of the 1001F config file (where it says model, firmware, etc), and paste that over the same lines in the 1000D config. Then import the modified 1000D config into the 1001F.

-> depending on the differences in firmware and model, this can lead to some errors!

-> some configuration might not transition properly, and need to be manually re-done

-> if you want to attempt this, please do so while having console access to the 1001F, so if anything goes wrong you can reconfigure or factory-reset to regain access/revert the changes

-> please do note that this is not a supported method of migration! It can be done, yes, but depending on configuration complexity, and model/firmware differences, following these steps might result in an unusable configuration file as settings cannot be applied during config upload