Transfer a FortiGate configuration file to a new FortiGate unit of a different model

[Xris76]

Hi to Everyone, We have an old Fortigate 200A and bought a new Model 100d. We exported the Config File from the 200A, edit the headers and Importing the .cfg to the 100d. It was necessary the Rename the Interfaces to. The Problem is now, many of the commands are no longer Supported in IOS 5. The 200A have IOS4. Downgrad on 100d to not Supported, Upgrad 200A not Supported. :-( Fortinet says, we can try to Upgrade the 200A, but this is no way for us, the Firewall is in productive. How we can handle this to export all configs from the 200A to 100d? Edit all Step by Step for each Rule and etc. be an Headcracking Job.... We have a lot of Policies, Rules and other things in the .cfg. Did somebody had the same Problem or any Solution for this. Thanks in Advance Regards from Germany - Munich

[Matthew_Mollenhauer]

There is no easy way unfortunately.

Aside from manually editing the config which is risky, the only thing I can think of is to use a FortiManager to import the current policy set from the 200A, then using the FMG install onto the 100D.

This would still require you to manually configure the interfaces & other system settings on the 100D, but it would allow an "automated" policy transfer.

We purchased a FMG-VM and in the last 6 months we have performed several hardware upgrades using it; we have done two 1240B -> 1500D HA cluster upgrades without issue (both upgrades were on clusters with 1000+ policies), we've also upgraded our 621B HA Cluster to 1240B's without issues.

Be aware, the unlicensed FortiManager-VM is restricted in the number of devices/vdom's it can handle. If you're using more than two vdom's on your 200A you'll have issues. There may be other restrictions that may stop this from working.

Regards,

Matthew

[Dave_Hall]

While migrating from 4.3 to 5.X is ideal, you can go in reverse one step (then go forward a step or two) by 1) downgrading the 100D to 4.3.18 (aka 4.3 MR3 patch 18), then 2) load the edited 100A config onto this 100D, then 3) upgrade the 100D to firmware 5.x. 

Checking the later 4.3.x firmwares, I see the 100D is supported, though there is a CSB (CSB-141117-1) that stipulates 4th Gen 100Ds are only supported on 4.3.18.

I don't have access to a 100D, but I assume the lower 8 ports are (by default) labelled "switch".  If the internal ports on the 200A are labelled internal -- you can just rename it to switch (on the edited config) before loading it into the 100D.

On each stage of the firmware upgrade, perform a "diag debug config-error-log read" on the CLI to see if there are any errors in the config.

Edit: I'm assuming of course, the original config on the 200A is set to switch mode (not interface mode). 

Edit2:  Also assuming the 200A is on/near 4.3.18.

[Xris76]

Hi,

ok, i will try it out. I hope this works fine for us.

Thanks for Help, i give you an feedback!!

Regards, Nice Sunday

Xris76

[Xris76]

Hello,

at last i can tell the migration of the config files now works for us. we bougt a 200a from ebay for 99€.

I downgraded the 100d to os4 and import the config file, edit the interfaces from the old config, edit the header from the config file, upgraded to os5, and it works fine. il test it at the evening in our produktion enviroment. Mails ok, webcontentfilter ok, vpn ok.

the same procedure works with 200a with a config file from 100a, import then to 100d .-)

Regards

Xris76

[Shawn_W]

Thanks this is good to know. 

[emnoc]

Same here just did and that's what we did exactly, We downgrade to a 4.3.X move the policies, IPS signatures, proof all and  then upgraded the units following the  suggested upgrade path to  5.0.9. It didn't take but maybe 42mins tops with carefully planning.

It's really not that hard, just make sure you break the config down and do it in section and  becareful of any dhcp configuration details.

[Yngve0]

I have several times earlier migrated configuration between models successfully with use of notepad & search/replace on interface names. Just ensured that the firmwarebuild is the same and changed the header to one matching the new unit.

Lately I have tried  the same approach twice; First between 200B to 200D and secong between 60C and 60D. Both failed with response: "Bad license" and the configuration is garbage. 

Anyone who have the same experience? I have noticed that the buildnumber for firmwareversions on the "D"-models does not match older model, but that should not be a issue?

[Dave_Hall]

Yngve Øines wrote:

Lately I have tried  the same approach twice; First between 200B to 200D and secong between 60C and 60D. Both failed with response: "Bad license" and the configuration is garbage. 

Anyone who have the same experience? I have noticed that the buildnumber for firmwareversions on the "D"-models does not match older model, but that should not be a issue?

I haven't encountered this error myself.  But mind you, I have rebuilt our base 5.0 configs from scratch rather than migrate over from 4.3, then I have used WinMerge to compare differences, making tweaks/adjustments and used "diagnose debug config-error-log read" to make sure there were no errors when I have loaded them.  Only real noticeable differences that I could tell is the 200D has WAN ports, hardware switch config def, and a HDD config def. 

But if I was tasked to migrating a 200B config over to the 200D (both on same/similar firmware), I would likely take the existing 200B config, rename the designate WAN port (port16 in my case) to WAN1 and use WinMerge to migrate the appropriate settings over to a clean/factory reset 200D config (keeping the 200D headers of course).

[emnoc]

I never seen this, if you go section by section starting with sys admin, sys interface, address/addrgroup, dhcp and  last firewall policies. Basically follow the sequence in your cut/paste as how the firewall  config looks and you should be able to move the stuff around.

You mind need to find and replace if you have port-name differences ( i.e port1 vrs internal1 ). I've probably have done a near hundred of these firewall migrations and they are all simple. But there's no simple  process  like 1 2 3  done. Just take you time.