Migration FGT200A 4.3 -> FGT200D 5.2.4

[omar52]

Hi,

Is it possible to convert the configuration  from FGT200A rel  4.3 to FGT200D rel 5.2.4 with Forticonverter 4.7 Trial ?

I've tried but there no result in the result page ...

Rgds

[BWiebe]

omar52 wrote:

Hi,

Is it possible to convert the configuration  from FGT200A rel  4.3 to FGT200D rel 5.2.4 with Forticonverter 4.7 Trial ?

I've tried but there no result in the result page ...

Rgds

I'm not familiar with the latest version of FortiConverter, but in general they don't allow a full conversion with the trial version of it.

To do this sort of conversion, is possible, manually, but difficult.

You could follow Fortinet's method for porting configurations between models:

http://docs.fortinet.com/uploaded/files/1702/Transferring_a_configuration_file_from_one_model_to_ano...

The problem is, these steps assume you have the same firmware on each device.

A way I've been successful in doing this in the past is twofold.

1) Port the 4.3 configuration over to a trial version of the Fortinet-VM following the fortinet process and confirm functionality.  Then backup the configuration of the VM, and follow the prescribed steps to update the VM to 5.2.4 and confirm functionality of the VM.

2) Once your VM is successfully upgraded, port its config to the 200D following the steps indicated to port the config.

I've used this methodology to successfully move over a few A devices to newer devices.

Thanks,

Brent

[omar52]

I've tried to Port the 4.3 configuration over to a trial version of the Fortinet-VM, but it seems that the trial version have some limitation. I can't create more than 20 local users (used for my SSL connections)

How I can manage this ?

[BWiebe]

omar52 wrote:

I've tried to Port the 4.3 configuration over to a trial version of the Fortinet-VM, but it seems that the trial version have some limitation. I can't create more than 20 local users (used for my SSL connections)

How I can manage this ?

A couple of possiblities I think.

1) from the 4.3 configuration - open in a text editor, like NotePad++ and copy the whole section starting with config user local and ending at the 'end' of your local user config.  Then paste this into the 5.2.* configuration file and upload it - or use the CLI in the 5.2 and paste it in. The base command structure for local users is the same between 4.3 and 5.2.  5.2 adds a number of features, but overall is setup the same way.

If that doesn't fully work

2) Reach out to Fortinet to see if they have any other options.  I know in the past, the normal trial (15 days) version had a few limitations, but I was able to get a fully-functioning 60 or 90 day trial directly from Fortinet of the Fortigate-VM to help with the duration of a number of projects I was working on when I did the exact sort of porting you are trying to do.

Thanks,

Brent

[g3rman]

If you can handle a couple of hours of downtime follow the upgrade process from 4.3 to 5.2.4 on the actual device.

Then, after the upgrades are complete save the config, reset the firewall to factory default and restore the 5.2.4 config.

Copying files over to VMs is doable but bears a lot of risk since you generally have to change interface mappings and what not.

[BWiebe]

g3rman wrote:

If you can handle a couple of hours of downtime follow the upgrade process from 4.3 to 5.2.4 on the actual device.

Then, after the upgrades are complete save the config, reset the firewall to factory default and restore the 5.2.4 config.

Copying files over to VMs is doable but bears a lot of risk since you generally have to change interface mappings and what not.

I think the major issue is that 200A doesn't support 5.2.* and the 200D only supposed 5.0.* and higher.

This is the same issue I used the above technique with for a number of clients (going from A level devices to C and D level devices or different devices entirely).  Yes - it bears risk, but when done carefully and tested at each step, it works well.

[g3rman]

Good point, I missed that it's also being migrated to another platform.