Replace broken fortigate

[sara03]

Hello all,

Sorry for the title but let me explain..

So a customer of ours have a broken fortigate 50E that will need to be replaced, they have done an RMA and will soon receive a new 50E (they have a plan to upgrade to a 61F soon as well).

Anyway, I was wondering if there is an easy way to do a backup and just upload the configuration to the new firewall? Usually, what I do in these kind of situations, I just do a backup of the old one, take that backup file and then upload to the script option in the new firewall.

But is there a better way to do this, a more simpler, efficient and secure way to do this task? One of the risks I'm thinking of (and please correct me if I'm wrong) is a syntax change between different models, especially when I need to replace the old 50E to the new 61F in the future. Not sure if there is a syntax change between models, more likely it would be between versions I would say, but not sure. It would suck to upload a config via the script options and then get many errors etc.

So

When replacing firewalls, is there a efficient, simpler and more secure way to do a backup and then upload it to the new firewall?

When for example doing a backup of an old fortigate, for example, let say when I will be replacing a 50E to a 61F later on, and let say that the the 50E is on version 6.4.11: before uploading the backup config of the 50E to 61F, I make the 61F to be on version 6.4.11, then uploading the backup config of 50E to 61F and then upgrading the 61F to for example 7.0.9 etc. Is that a good way to go?

Appreciate all help!

[KumarV]

Hello Sara,

No, we cannot upload a 50E configuration file directly to 61F. They are totally different models and will mess up the configuration file on 61F. The best and easiest way to do it is to use Forticonvertor services. You can follow this link for registration of Forticonvertor License Purchase Options | FortiConverter Service 20.1.0 (fortinet.com)  In Forticonvertor you can simply select the models and upload the configuration and it will convert it to 61F.

[Yurisk]

Hi, 

beyond Forticonverter already mentioned, there is no "easy" way (by easy mean click-click-double click) to convert configs between different models. About the Forticonverter thing - you have 2 ways to get it: as a one time service from Fortinet, or as a standalone software subscription on premises. The price of on-premises software is too high to justify with upgrading 1 FGT (or even 10 for that matter, a search on Google gives estimated price of 3995$ ) , one-time service is included in some subscriptions, not sure of the details.

As others on reddit mentioned - FGT 50E will hardly have any complex configuration to try and automate this. The way you do it - exporting config, fixing interface names/zones and such, then importing it is the usual way for such cases. 

I, personally, once had to migrate config from one failed FGT 1500D to another (with VDOMs), while the destination one having partial configs in place already, it wasn't fun, but in 1,5  hour it was up and running in a new place. So, when there is a will, there is a way :).