MIGRATING FROM OLD FORTIGATE 200F to NEW FORTIGATE 200F

[tenvuladu]

I am migrating from a FortiGate 200F to another FortiGate 200F.

I did the initial Logging and then created an admin password.

then i used the restore function to restore the previous config to the new one.

the issues now are that, I am not able to log in using the admin Login i created or any of the login credentials from the restored.

Is there something else i should have done ?

[Toshi_Esumi]

Are you sure both 200Fs are running the same version? That's the only thing I can think of that might cause admin credential to break.
If you have restored the entire config file you backed up from the original 200F at the new 200F running the same version, literally everything, including the host name and all admin credentials, should be replaced by the original config.
I would recommend trying the console port to login with the original 200F's admin user.

Toshi

[tenvuladu]

Thank you for your response @Toshi_Esumi . Yes it was the same.

One more issue is that we lost the Admin credentials for the last Fortigate 200F, so we want to have the one for the new one since we can't recover that last one.

We want to restore the old config to the new one and set new admin credentials.

[Rhill]

Hello tenvuladu,

If you just want to restore an old config, I just went through this this week for the first time.  It is pretty straight forward. 

You'll need a console cable(and possibly right drivers on Windows), terminal program such as putty, a TFTP server (I used SolorWinds as it is a free program and worked well), and the correct firmware downloaded to match your config file.  Look on Fortinet's support site for the documentation on the whole process.  

Basically, you use the console cable to monitor the boot process.  Early in the boot process, it will display a message such as "Please wait for OS to boot, or press any key to display configuration menu."  Press a key and it will give you a menu. Set the proper settings on your computer and firewall to match to communicate.  On the 200F, the MGMT port is the port you want to upload the firmware from the TFTP server on your computer.  After the firmware is installed, you have a default firewall.  Log in as starting new.  Then restore your configuration file, and you should be off and running assuming the firmware matches the config file version.

Here is a link for an example of steps: Technical Note: TFTP firmware upload on F... - Fortinet Community You can probably find a lot of examples online.

Good luck and I hope this helps you.   

[Toshi_Esumi · Accepted solution]

If you don't have admin credential at the original 200F, how were you able to backup the config before uploading it at the new 200F?
Anyway, since "maintainer" no longer work after 7.2.x, what I would do to set a new admin credential with the backup config is:
1. default the new 200F and set up whatever you want as a new admin username/password.

2. backup the new 200F config into a file and open it with an editor.
3. copy the new admin config including the encrypted password under "config sys admin". It would look like below:
config system admin
  edit "admin"
    set accprofile "super_admin"
    set vdom "root"
    set password ENC <encrypted_password_hash>
  next
end
4. open the backup config file from the old 200F with an editor.
5. paste(insert if the same admin username doesn't exist already) the "edit <username>" to "next" you just copied into the config sys admin section of the old 200F's config, then save.
6. finally upload the modified old 200F's config file into the new 200F, so-called "restore".

Then you can log in with the new credential but the new 200F has the rest of old 200F's config.

Toshi

[elliottmohr]

When restoring a full config backup, it also overwrites the admin credentials with those from the old device. So, try logging in using the admin credentials from the original (old) FortiGate. If that doesn’t work, you may need to factory reset the new device and reconfigure it using a cleaned (manually adjusted) config that matches the new device’s interface and settings.