Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
There is no easy way unfortunately.
Aside from manually editing the config which is risky, the only thing I can think of is to use a FortiManager to import the current policy set from the 200A, then using the FMG install onto the 100D.
This would still require you to manually configure the interfaces & other system settings on the 100D, but it would allow an "automated" policy transfer.
We purchased a FMG-VM and in the last 6 months we have performed several hardware upgrades using it; we have done two 1240B -> 1500D HA cluster upgrades without issue (both upgrades were on clusters with 1000+ policies), we've also upgraded our 621B HA Cluster to 1240B's without issues.
Be aware, the unlicensed FortiManager-VM is restricted in the number of devices/vdom's it can handle. If you're using more than two vdom's on your 200A you'll have issues. There may be other restrictions that may stop this from working.
Regards,
Matthew
While migrating from 4.3 to 5.X is ideal, you can go in reverse one step (then go forward a step or two) by 1) downgrading the 100D to 4.3.18 (aka 4.3 MR3 patch 18), then 2) load the edited 100A config onto this 100D, then 3) upgrade the 100D to firmware 5.x.
Checking the later 4.3.x firmwares, I see the 100D is supported, though there is a CSB (CSB-141117-1) that stipulates 4th Gen 100Ds are only supported on 4.3.18.
I don't have access to a 100D, but I assume the lower 8 ports are (by default) labelled "switch". If the internal ports on the 200A are labelled internal -- you can just rename it to switch (on the edited config) before loading it into the 100D.
On each stage of the firmware upgrade, perform a "diag debug config-error-log read" on the CLI to see if there are any errors in the config.
Edit: I'm assuming of course, the original config on the 200A is set to switch mode (not interface mode).
Edit2: Also assuming the 200A is on/near 4.3.18.
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Hi,
ok, i will try it out. I hope this works fine for us.
Thanks for Help, i give you an feedback!!
Regards, Nice Sunday
Xris76
Hello,
at last i can tell the migration of the config files now works for us. we bougt a 200a from ebay for 99€.
I downgraded the 100d to os4 and import the config file, edit the interfaces from the old config, edit the header from the config file, upgraded to os5, and it works fine. il test it at the evening in our produktion enviroment. Mails ok, webcontentfilter ok, vpn ok.
the same procedure works with 200a with a config file from 100a, import then to 100d .-)
Regards
Xris76
Thanks this is good to know.
Same here just did and that's what we did exactly, We downgrade to a 4.3.X move the policies, IPS signatures, proof all and then upgraded the units following the suggested upgrade path to 5.0.9. It didn't take but maybe 42mins tops with carefully planning.
It's really not that hard, just make sure you break the config down and do it in section and becareful of any dhcp configuration details.
PCNSE
NSE
StrongSwan
I have several times earlier migrated configuration between models successfully with use of notepad & search/replace on interface names. Just ensured that the firmwarebuild is the same and changed the header to one matching the new unit.
Lately I have tried the same approach twice; First between 200B to 200D and secong between 60C and 60D. Both failed with response: "Bad license" and the configuration is garbage.
Anyone who have the same experience? I have noticed that the buildnumber for firmwareversions on the "D"-models does not match older model, but that should not be a issue?
Yngve Øines wrote:Lately I have tried the same approach twice; First between 200B to 200D and secong between 60C and 60D. Both failed with response: "Bad license" and the configuration is garbage.
Anyone who have the same experience? I have noticed that the buildnumber for firmwareversions on the "D"-models does not match older model, but that should not be a issue?
I haven't encountered this error myself. But mind you, I have rebuilt our base 5.0 configs from scratch rather than migrate over from 4.3, then I have used WinMerge to compare differences, making tweaks/adjustments and used "diagnose debug config-error-log read" to make sure there were no errors when I have loaded them. Only real noticeable differences that I could tell is the 200D has WAN ports, hardware switch config def, and a HDD config def.
But if I was tasked to migrating a 200B config over to the 200D (both on same/similar firmware), I would likely take the existing 200B config, rename the designate WAN port (port16 in my case) to WAN1 and use WinMerge to migrate the appropriate settings over to a clean/factory reset 200D config (keeping the 200D headers of course).
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
I never seen this, if you go section by section starting with sys admin, sys interface, address/addrgroup, dhcp and last firewall policies. Basically follow the sequence in your cut/paste as how the firewall config looks and you should be able to move the stuff around.
You mind need to find and replace if you have port-name differences ( i.e port1 vrs internal1 ). I've probably have done a near hundred of these firewall migrations and they are all simple. But there's no simple process like 1 2 3 done. Just take you time.
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1712 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.