Migrating system settings from FortiGate 30E to FortiWiFi-60F

[slartibartfast]

As part of an office move we are upgrading from a FortiGate 30E to a FortiWiFi-60F security appliance. Is it possible to save the 30E settings (users, network, VPN, etc.) and restore them to the 60F? (Obviously settings that don't exist on the 30E such as WiFi would still need to be set up manually.) Or is it necessary to copy the settings by hand?

[lobstercreed · Accepted solution]

Sure!  There are several ways to tackle this, but probably the easiest is to take an unencrypted backup of both configs from the GUI and compare them, copying the sections you want from the 30E config into the 60F config.  Then you can restore the "edited" config to the 60F and you should have the things you wanted.  Just be conscience of any differences that may exist between versions and platforms (interface names for example). 

The safer thing to do might be to take those sections from the 30E that you want to copy over and just paste them into the 60F CLI.  That way you can see any errors right there and fix them as you go.  Either way you'll probably want to start by comparing backup configs.

[slartibartfast]

Thanks, that sounds like a good way to approach it!

[sw2090]

you could also try to use FortiConverter to convert it. Unfortunately the last time I used it it kept not converting my interface settings.

[slartibartfast]

sw2090 wrote:

you could also try to use FortiConverter to convert it. Unfortunately the last time I used it it kept not converting my interface settings.

If it came down to it, it would not be all that difficult to replicate the settings by hand since we're not doing anything exotic. Maybe 1/2 dozen users, SSL and IPsec VPNs, WAN+LAN settings and a handful of port forwards. I just thought it would save some time to be able to import the old settings directly. I'll compare the saved configs on both devices and if not too much cleanup is needed I'll edit and import the old settings, otherwise will just set up from scratch via the GUI.

Thanks for the suggestions!

[sw2090]

yeah that's the way I mostly do it.

If you make sure you run the same FortiOS Versopn on both devices you should have the least problems.

Then the biggest thing is that interface names and -layout may be different and has to be worked on due to that.

Policies, VPN, Users etc (except from referred interfaces) should not need any change.

The only thing that can happen is that some option or command that existet on the old device does not exist on the new one (had that a very few times).

So you should be able to just copy paste some 95% of your config :)

If devices are rather indentical like my FGT100D and FGT100E here you can even apply the complete backup. Those have the same interface names and layout and only are different beyond the hood. So all I have to do is to replace the fist 3 or 4 lines in the 100D Backup by thos from a backup from a 100E. I also replaced the serial number in the 100D Backup by the one from the new 100E.

Then I was able to restore that backup to the 100E without any issues.

[ede_pfau]

One more hint:

make sure you KEEP the first 3 commented-out lines of the target FGT. So, before configuring, right after unboxing, back up the config of the new unit to get these.

Make sure the username in the very first line is identical to the one you will use to import the converted config - with a brand new FGT, usually 'admin'.