Step 1

On your computer, create a folder for the Secure Firewall migration tool.

Step 2

Browse to https://software.cisco.com/download/home/286306503/type and click Firewall Migration Tool.

Step 3

Download the most recent version of the Secure Firewall migration tool into the folder that you created.

Step 4

If you are a Security Cloud Control user and want to use the migration tool hosted on it, log in to your Security Cloud Control tenant and on the left pane, navigate to Administration > Migration > Firewall Migration Tool to create your migration instance.

Step 1

From the FortiGate GUI, choose Admin > Configuration > Backup .

Step 2

Direct the backup to your local PC or to a USB disk.

Step 3

Select the VDOM name from the VDOM list if the back up is a VDOM configuration.

Step 4

Select Ok.

Step 1

On your computer, navigate to the folder where you downloaded the Secure Firewall migration tool.

Step 2

Do one of the following:

• On your Windows machine, double-click the Secure Firewall migration tool executable to launch it in a Google Chrome browser.

  If prompted, click Yes to allow the Secure Firewall migration tool to make changes to your system.

  Note	Ensure you disable any popup blockers in your browser because they might hinder login popus from appearing.

  The Secure Firewall migration tool creates and stores all related files in the folder where it resides, including the log and resources folders.

• On your Mac move, the Secure Firewall migration tool *.command file to the desired folder, launch the Terminal application, browse to the folder where the Secure Firewall migration tool is installed and run the following commands:

  # chmod 750 Firewall_Migration_Tool-version_number.command

  # ./Firewall_Migration_Tool-version_number.command

  The Secure Firewall migration tool creates and stores all related files in the folder where it resides, including the log and resources folders.

  Tip

  When you try to open the Secure Firewall migration tool, you get a warning dialog because the Secure Firewall migration tool is not registered with Apple by an identified developer. For information on opening an application from an unidentified developer, see Open an app from an unidentified developer.

  Note	Use MAC terminal zip method.

Step 3

On the End User License Agreement page, click I agree to share data with Cisco Success Network if you want to share telemetry information with Cisco, else click I'll do later.

Step 4

On the Secure Firewall migration tool's login page, do one of the following:

• To share statistics with Cisco Success Network, click the Login with CCO link to log in to your Cisco.com account using your single sign-on credentials. If you do not have a Cisco.com account, create it on the Cisco.com login page.

  Proceed to step 8, if you have used your Cisco.com account to log in.

• If you have deployed your firewall in an air-gapped network that does not have internet access, contact Cisco TAC to receive a build that works with administrator credentials. Note that this build does not send usage statistics to Cisco, and TAC can provide you the credentials.

Step 5

On the Reset Password page, enter the old password, your new password, and confirm the new password.

Step 6

Click Reset.

Step 7

Log in with the new password.

Step 8

Review the premigration checklist and make sure you have completed all the items listed.

Step 9

Click New Migration.

Step 10

On the Software Update Check screen, if you are not sure you are running the most recent version of the Secure Firewall migration tool, verify the version on Cisco.com.

Step 11

Click Proceed.

Step 1

Step 2

Review the Context Selection section and select the Fortinet VDOM that you want to migrate.

Step 3

Click Start Parsing.

Step 4

Review the summary of the elements in the uploaded configuration file that the Secure Firewall migration tool detected and parsed.

Step 1

On the Select Target screen, in the Firewall Management section, do the following: you can choose to migrate to an On-Prem Firewall Management Center or Cloud-delivered Firewall Management Center:

1. Click the On-Prem FMC radio button.

2. Enter the IP address or Fully-Qualified Domain Name (FQDN) for the management center.

3. In the Domain drop-down list, select the domain to which you are migrating.

   If you want to migrate to a threat defense device, you can only migrate to the threat defense devices available in the selected domain.

4. Click Connect and proceed to Step 2.

1. Click the Cloud-delivered FMC radio button.

2. Choose the region and paste the Security Cloud Control API token. For generating the API token. from Security Cloud Control, follow the below steps:

   1. Log in to Security Cloud Control.

   2. From the top-right corner, navigate to Preferences > General Preferences and copy the API Token from My Tokens section.

3. Click Connect and proceed to Step 2.

Step 2

In the Firewall Management Center Login dialog box, enter the username and password of the dedicated account for the Secure Firewall migration tool, and click Login.

Step 3

Click Proceed.

Step 4

In the Choose FTD section, do one of the following:

• Click the Select FTD Device drop-down list and check the device where you want to migrate the Fortinet configuration.

  The devices in the selected management center domain are listed by IP Address, Name, Device Model, and Mode (routed or transparent).

  Note

  At minimum, the native threat defense device you choose must have the same number of physical or port channel interfaces as the Fortinet configuration that you are migrating. At minimum, the container instance of the threat defense device must have the same number of physical or port channel interfaces and subinterfaces. You must configure the device with the same firewall mode as the Fortinet configuration. However, these interfaces do not have to have the same names on both devices.

  Note

  Only when the supported target threat defense platform is Firewall 1010 with management center version 6.5 or later.6.5, FDM 5505 migration support is applicable for shared policies and not for device specific policies. When you proceed without threat defense, the Secure Firewall migration tool will not push any configurations or the policies to the threat defense. Thus, interfaces and routes, and site-to-site VPN which are threat defense device-specific configurations will not be migrated. However, all the other supported configurations (shared policies and objects) such as NAT, ACLs, and port objects will be migrated. Remote Access VPN is a shared policy and can be migrated even without threat defense.

  Fortinet firewall migration to management center or threat defense 6.7 or later with the Remote deployment enabled is supported by the Secure Firewall migration tool. However, migration of Interface and Routes must be migrated manually.

• Click Proceed without FTD to migrate the configuration to the management center.

  When you proceed without threat defense, the Secure Firewall migration tool will not push any configurations or the policies to threat defense. Thus, interfaces and routes, and site-to-site VPN which are threat defense device-specific configurations will not be migrated and need to be manually configured on management center. However, all the other supported configurations (shared policies and objects) such as NAT, ACLs, and port objects will be migrated. Remote Access VPN is a shared policy and can be migrated even without threat defense.

Step 5

Click Proceed.

Step 6

Click the Select Features section to review and select the features that you want to migrate to the destination.

• If you are migrating to a destination threat defense device, the Secure Firewall migration tool automatically selects the features available for migration from the Fortinet configuration in the Device Configuration and Shared Configuration sections. You can further modify the default selection, according to your requirements.
• If you are migrating to a management center, the Secure Firewall migration tool automatically selects the features available for migration from the Fortinet configuration in the Device Configuration, Shared Configuration, and Optimization sections. You can further modify the default selection, according to your requirements.
• If you are migrating a configuration from a Fortinet firewall, and if you have VPN configured in your Fortinet firewall, ensure that you do the following on the Select Features pane:

  • The migration tool displays your site-to-site VPN features under Device Configuration. Select Policy Based (Crypto Map) or Route Based (VTI), depending on your requirement.

  • The migration tool displays your remote-access VPN features under Shared Configuration.

  • Select SSL VPN or both IPsec VPN and SSL VPN.

    Note	You cannot select only IPsec VPN because pre-shared key-based (PSK-based) or certificate-based authentication is not supported in management center for remote access VPN configurations.

  If your Fortinet firewall configuration has site-to-site and remote access VPN configured, they are selected by default in the Select Features pane. Use the checkboxes to unselect them, if required.

• The Secure Firewall migration tool supports Destination Security Zones that enable mapping of destination zones for the ACL during migration.

  Based on the nature of source and destination network object or groups and service object or groups, this operation may result in ACL rule explosion when migrating from Fortinet to management center.

• (Optional) In the Optimization section, select Migrate only referenced objects to migrate only those objects that are referenced in an access control policy and a NAT policy.

  Note	When you select this option, unreferenced objects in the Fortinet configuration will not be migrated. This optimizes migration time and cleans out unused objects from the configuration.

Step 7

Click Proceed.

Step 8

In the Rule Conversion/ Process Config section, click Start Conversion to initiate the conversion.

Step 9

Review the summary of the elements that the Secure Firewall migration tool converted.

Step 10

Click Download Report and save the Pre-Migration Report.

Step 1

Navigate to where you downloaded the Pre-Migration Report.

Step 2

Open the Pre-Migration Report and carefully review its contents to identify any issues that can cause the migration to fail.

Step 3

If the Pre-Migration Report recommends corrective actions, complete those corrections on the Fortinet interface, export the Fortinet configuration file again and upload the updated configuration file before proceeding.

Step 4

After your Fortinet configuration file is successfully uploaded and parsed, return to the Secure Firewall migration tool, and click Next to continue the migration.

Step 1

If you want to change an interface mapping, click the drop-down list in the FTD Interface Name and choose the interface that you want to map to that Fortinet interface.

Step 2

When you have mapped each Fortinet interface to a threat defense interface, click Next.

Step 1

To map interfaces to security zones and interface groups that exist in management center, or that is available in configuration files as Security Zone type objects and is available in the drop-down list, do the following:

1. In the Security Zones column, choose the security zone for the interface.

2. In the Interface Groups column, choose the interface group for the interface.

Step 2

To map interfaces to security zones that exist in management center, in the Security Zones column, choose the security zone for that interface.

Step 3

You can manually map or auto-create the security zones.

1. Click Add SZ.

2. In the Add SZ dialog box, click Add to add a new security zone.

3. Enter the security zone name in the Security Zone column. The maximum characters allowed is 48.

4. Click Close.

1. Click Auto-Create.

2. In the Auto-Create dialog box, check Zone Mapping.

3. Click Auto-Create.

Step 4

When you have mapped all interfaces to the appropriate security zones, click Next.

Step 1

On the Optimize, Review and Validate Configuration screen, click Access Control Rules and do the following:

1. For each entry in the table, review the mappings and verify that they are correct.

   A migrated access policy rule uses the ACL name as prefix and appends the ACL policy ID to it to make it easier to map back to the Fortinet configuration file. For example, if a Fortinet ACL is named "inside_access", then the first rule (or ACE) line in the ACL will be named as "inside_access_#1". If a rule must be expanded because of TCP/UDP combinations, an extended service object, or some other reason, the Secure Firewall migration tool adds a numbered suffix to the name. For example, if the allow rule is expanded into two rules for migration, they are named "inside_access _#1-1" and " inside_access_#1-2".

   For any rule that includes an unsupported object, the Secure Firewall migration tool appends an "_UNSUPPORTED" suffix to the name.

2. If you do not want to migrate one or more access control list policies, choose the rows by checking the box against the policy, choose Actions > Do not migrate and then click Save.

   All rules that you choose not to migrate are grayed out in the table.

3. To edit an access control list policy, select the row by checking the check box for the policy, and choose Actions > Edit.

   Edit Rule dialog box appears. You can update existing data or add new data in the chosen policy.

   To add an object to source or destination:

   1. Choose the object from the left pane by checking the check box for it.

   2. Click the Add Source or Add Destination button under Selected Sources or Selected Destination and Applications column to move the object to the respective location.

   You can also delete the existing object from the source or destination by clicking the delete icon.

   All rules that are not applicable are grayed out in the table.

4. If you want to apply a management center file policy to one or more access control policies, check the box for the appropriate rows, choose Actions > File Policy.

   In the File Policy dialog, select the appropriate file policy and apply it to the selected access control policies and click Save.

5. If you want to apply a management center IPS policy to one or more access control policies, check the box for the appropriate rows, choose Actions > IPS Policy.

   In the IPS Policy dialog, select the appropriate IPS policy and its corresponding variable set and apply it to the selected access control policies and click Save.

6. If you want to change the logging options for an access control rule which has logging enabled, check the box for the appropriate row and choose Actions > Log.

   In the Log dialog, you can enable logging events either at the beginning or end of a connection or both. If you enable logging, you must opt to send the connection events either to the Event Viewer or to the Syslog or both. When you opt to send connection events to a syslog server, you can choose the syslog policies that are already configured on the management center from the Syslog drop-down menu.

7. If you want to change the actions for the migrated access control rules in the Access Control table, check the box for the appropriate row and choose Actions > Rule Action.

   Tip	The IPS and file policies that are attached to an access control rule are automatically removed for all rule actions except for the Allow option.

   You can filter the ACE counts in the ascending, descending, equal, greater than, and lesser than filtering order sequence.

   To clear the existing filter criteria, and to load a new search, click Clear Filter.

   Note	The order that you sort the ACL based on ACE is for viewing only. The ACLs are pushed based on the chronological order in which they occur.

Step 2

Click the following tabs and review the configuration items:

Step 3

(Optional) While reviewing your configuration, you can rename one or more network or port objects in the Network Objects or the Port Objects tab by selecting the object and choosing Actions > Rename.

Step 4

You can view routes from the Routes area and select the routes that you do not want to migrate, by selecting an entry and choosing Actions > Do not migrate.

Step 5

In the Site-to-Site VPN Tunnels section, the VPN tunnels from the source firewall configurations are listed. Review the VPN tunnel data such as Source Interface, VPN Type, and IKEv1 and IKEv2 configurations for each row and ensure that you provide the preshared key values for all the rows.

Step 6

For configurations containing several site-to-site VPN tunnel configurations, to update the preshared keys for multiple entries at once, follow the steps below:

Step 7

In the Remote Access VPN section, all objects corresponding to remote access VPN are migrated from Fortinet to the management center, and are displayed:

Step 8

(Optional) To download the details for each configuration item in the grid, click Download.

Step 9

After you have completed your review, click Validate. Note that the mandatory fields that need your attention keeps flickering until you enter values in them. The Validate button gets enabled only after all the mandatory fields are filled.

Step 10

When the validation is complete, if the Validation Status dialog box shows one or more object conflicts, do the following:

1. Click Resolve Conflicts.

   The Secure Firewall migration tool displays a warning icon on either or both of the Network Objects or Port Objects tab, depending upon where the object conflicts were reported.

2. Click the tab and review the objects.

3. Check the entry for each object that has a conflict and choose Actions > Resolve Conflicts.

4. In the Resolve Conflicts window, complete the recommended action.

   For example, you might be prompted to add a suffix to the object name to avoid a conflict with the existing management center object. You can accept the default suffix or replace it with one of your own.

5. Click Resolve.

6. When you have resolved all object conflicts on a tab, click Save.

7. Click Validate to revalidate the configuration and confirm that you have resolved all object conflicts.

Step 11

When the validation is complete and the Validation Status dialog box displays the message Successfully Validated, continue with Push the Migrated Configuration to Management Center.

Step 1

In the Validation Status dialog box, review the validation summary.

Step 2

Click Push Configuration to send the migrated Fortinet configuration to management center.

Step 3

After the migration is complete, click Download Report to download and save the post-migration report.

Step 4

If your migration failed, review the post-migration report, log file, and unparsed file carefully to understand what caused the failure.

Step 1

Navigate to where you downloaded the Post-Migration Report.

Step 2

Open the post-migration report and carefully review its contents to understand how your Fortinet configuration was migrated:

Step 3

Open the Pre-Migration Report and make a note of any Fortinet configuration items that you must migrate manually on the threat defense device.

Step 4

In management center, do the following:

1. Review the migrated configuration for the threat defense device to confirm that all expected rules and other configuration items, including the following, were migrated:

   • Access control lists (ACL)

   • Network Address Translation rules

   • Port and network objects

   • Routes

   • Interfaces

2. Configure all partially supported, unsupported, ignored, and disabled configuration items and rules that were not migrated.

   For information on how to configure these items and rules, see the Management Center Configuration Guide. The following are examples of configuration items that require manual configuration:

   • Platform settings, including SSH and HTTPS access, as described in Platform Settings for Threat Defense

   • Syslog settings, as described in Configure Syslog

   • Dynamic routing, as described in Routing Overview for Threat Defense

   • Service policies, as described in FlexConfig Policies

   • VPN configuration, as described in Threat Defense VPN

   • Connection log settings, as described in Connection Logging

Step 5

After you have completed your review, deploy the migrated configuration from management center to the threat defense device.

Step 1

Save a copy of the Global or per–VDOM configuration from the source Fortinet that you want to migrate.

Step 2

Deploy the Firepower 2100 series device in your network, connect the interfaces and power on the appliance.

Step 3

Register the Firepower 2100 series device to be managed by the management center.

Step 4

(Optional) If your source Fortinet configuration has aggregate interfaces, create port channels (EtherChannels) on the target Firepower 2100 series device.

Step 5

Download and run the most recent version of the Secure Firewall migration tool from https://software.cisco.com/download/home/286306503/type.

Step 6

When you launch the Secure Firewall migration tool, and specify destination parameters, make sure that you select the Firepower 2100 series device that you registered to the management center.

Step 7

Map the Fortinet interfaces with the threat defense interfaces.

Step 8

While mapping logical interfaces to security zones, click Auto-Create to allow the Secure Firewall migration tool to create new security zones. To use existing security zones, manually map the Fortinet logical interfaces to the security zones.

Step 9

Follow the instructions of this guide to sequentially review and validate the configuration to be migrated, and then push the configuration to the management center.

Step 10

Review the Post Migration report, manually setup and deploy other configurations to the threat defense and complete the migration.

Step 11

Test the Firepower 2100 series device using the test plan that you would have created while planning for migration.

Step 1

Clear the Address Resolution Protocol (ARP) cache on the surrounding switching infrastructure.

Step 2

Perform basic ping tests from surrounding switching infrastructure to the Firepower 2100 series device interface IP addresses, to make sure that they are accessible.

Step 3

Perform basic ping tests from devices which require layer 3 routing to Firepower 2100 series device interface IP addresses.

Step 4

If you are assigning a new IP address to the Firepower 2100 series device and not reusing the IP address assigned to the perform the following steps:

Step 5

Run a comprehensive test plan and monitor logs within the managing management center for your Firepower 2100 device.