Hello to the FORTIGATE community
As the title says, I am in the middle of a project that consist of moving from CISCO to FORTIGATE. I am new to routing world and I have been learning lots of new things... Can someone help me do this? I am willing to provide any information needed like all the configuration that my CISCO have right now. If someone knows about the two systems and is willing to help please PM me. Thanks.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Yeah forticonverter sounds good but what are you migrating from and too?
pix
asa
security-router
to a cluster fortigate?
NOTE: If you don't have experience you should contract with a fortinet partner or consultant. professional services could be offer to easily lift and move from vendor XYZ to Fortinet
PCNSE
NSE
StrongSwan
emnoc wrote:Yeah forticonverter sounds good but what are you migrating from and too?
pix
asa
security-router
to a cluster fortigate?
NOTE: If you don't have experience you should contract with a fortinet partner or consultant. professional services could be offer to easily lift and move from vendor XYZ to Fortinet
I checked the forticonverter but it will convert all the old configurations that I dont really need.
I am moving from a Cisco 2801 to a 100D
And yeah it seems I am going to need to pay anyway.
Centrocito wrote:
I checked the forticonverter but it will convert all the old configurations that I dont really need.
You can tell FortiConverter to remove unused objects. That's one of the reasons it gives cleaner results than migrating manually.
FortiConverter was designed, among other things, to accelerate professional services.
Than take out the cfg that's not relevent or that you don't need. What I would do if your moving from let's say a pix or asa, define your L3 interfaces or if transparent mode, define your 2 in/out interfaces 1st.
Than do all firewall address ( objects in cisco lingo ) and then do any firewall polices
lastly, the vpn and other misc.
Dump all of the polices and do a audit b4 and after and you might find you have to clean up a few items. A <50 line or less PIX or ASA is nothing. A 51-1000 line fwpolicy pix/asa might be more challenging but still is not to hard. When you get into >1001 than that could become stressful.
PCNSE
NSE
StrongSwan
It's not hard.. I'm converting from ASA5510's and 5505's to FG.. The best advice I can give you is a Fortigate calls a NAT, a VIP. Virtual IP. Why I have no idea..
Also in the cookbook I read when deploying it for the first them the example they give you for doing a VIP(NAT) they combine the VIP and PAT into the same statement! If you follow this you'll need a VIP statement for every freeken port on a server. This would be fine if the server only has 1 port.. but my god WHY!..
Just leave the port part empty and control it like normal in the firewall rule.
Best part of a FG is the "show" and "get" command when you are in a subsection of the CLI.. I"ve always wanted to know why Cisco can't do something like this!
300E x3, 200D, 140D, 94D, 90D x2, 80D, 40C, handful of 60E's.. starting to loose track.
Over 100 WiFi AP's and growing.
FAZ-200D
FAC-VM 2 node cluster
Friends don't let friends FWF!
bartman10, on Cisco, are you aware of "do show running-config" etc. when within the "en / conf t" scope? Basically use your typical command, but insert "do" in front of it to be able to execute the command while in a configure shell.
IMO, it's not as nice as Fortinet's "show" and "get" ... But may help you if you have a mixed environment.
Best part of a FG is the "show" and "get" command when you are in a subsection of the CLI.. I"ve always wanted to know why Cisco can't do something like this!
And the cisco ASA and PIX both has had show commands for sections within the enable or config mode
E.g
show run access-list ( will display acl i.e could be your firewall policies )
show run crypto ( show vpn details )
show run tunnel-group ( vpn peers )
show run dhcpd ( dhcp servers)
IOS-XR would be the most similar with show within the configuration mode and sections. So yes cisco ASA OSes it's not " fortiOS", but it's cisco and it good & simple for those who has experience within. Show commands in cisco ASA are very similar built to a fortigate show/get in some places and areas it's better.
e.g
IOS show redirection and matches vrs the fortinet limited "grep"
btw; JunOS is also similar to FortiOS with show commands with the additions of display set and match options. As a matter of factor it's better than cisco and even Fortinet imho and experience.
PCNSE
NSE
StrongSwan
yes.. I know those commands.. but it's still not as slick as just "show,get" in the sub-menu I'm currently in..
300E x3, 200D, 140D, 94D, 90D x2, 80D, 40C, handful of 60E's.. starting to loose track.
Over 100 WiFi AP's and growing.
FAZ-200D
FAC-VM 2 node cluster
Friends don't let friends FWF!
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1641 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.