Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
slartibartfast
New Contributor

Migrating system settings from FortiGate 30E to FortiWiFi-60F

As part of an office move we are upgrading from a FortiGate 30E to a FortiWiFi-60F security appliance. Is it possible to save the 30E settings (users, network, VPN, etc.) and restore them to the 60F? (Obviously settings that don't exist on the 30E such as WiFi would still need to be set up manually.) Or is it necessary to copy the settings by hand?

1 Solution
lobstercreed
Valued Contributor

Sure!  There are several ways to tackle this, but probably the easiest is to take an unencrypted backup of both configs from the GUI and compare them, copying the sections you want from the 30E config into the 60F config.  Then you can restore the "edited" config to the 60F and you should have the things you wanted.  Just be conscience of any differences that may exist between versions and platforms (interface names for example). 

 

The safer thing to do might be to take those sections from the 30E that you want to copy over and just paste them into the 60F CLI.  That way you can see any errors right there and fix them as you go.  Either way you'll probably want to start by comparing backup configs.

View solution in original post

6 REPLIES 6
lobstercreed
Valued Contributor

Sure!  There are several ways to tackle this, but probably the easiest is to take an unencrypted backup of both configs from the GUI and compare them, copying the sections you want from the 30E config into the 60F config.  Then you can restore the "edited" config to the 60F and you should have the things you wanted.  Just be conscience of any differences that may exist between versions and platforms (interface names for example). 

 

The safer thing to do might be to take those sections from the 30E that you want to copy over and just paste them into the 60F CLI.  That way you can see any errors right there and fix them as you go.  Either way you'll probably want to start by comparing backup configs.

slartibartfast

Thanks, that sounds like a good way to approach it!

sw2090

you could also try to use FortiConverter to convert it. Unfortunately the last time I used it it kept not converting my interface settings.

 

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
slartibartfast

sw2090 wrote:

you could also try to use FortiConverter to convert it. Unfortunately the last time I used it it kept not converting my interface settings.

If it came down to it, it would not be all that difficult to replicate the settings by hand since we're not doing anything exotic. Maybe 1/2 dozen users, SSL and IPsec VPNs, WAN+LAN settings and a handful of port forwards. I just thought it would save some time to be able to import the old settings directly. I'll compare the saved configs on both devices and if not too much cleanup is needed I'll edit and import the old settings, otherwise will just set up from scratch via the GUI.

 

Thanks for the suggestions!

sw2090

yeah that's the way I mostly do it.

If you make sure you run the same FortiOS Versopn on both devices you should have the least problems.

Then the biggest thing is that interface names and -layout may be different and has to be worked on due to that.

Policies, VPN, Users etc (except from referred interfaces) should not need any change.

The only thing that can happen is that some option or command that existet on the old device does not exist on the new one (had that a very few times).

So you should be able to just copy paste some 95% of your config :)

 

If devices are rather indentical like my FGT100D and FGT100E here you can even apply the complete backup. Those have the same interface names and layout and only are different beyond the hood. So all I have to do is to replace the fist 3 or 4 lines in the 100D Backup by thos from a backup from a 100E. I also replaced the serial number in the 100D Backup by the one from the new 100E.

Then I was able to restore that backup to the 100E without any issues.

 

 

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
ede_pfau
Esteemed Contributor III

One more hint:

make sure you KEEP the first 3 commented-out lines of the target FGT. So, before configuring, right after unboxing, back up the config of the new unit to get these.

Make sure the username in the very first line is identical to the one you will use to import the converted config - with a brand new FGT, usually 'admin'.

 


Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
Labels
Top Kudoed Authors