Fortinet black logo

online help

General limitations

Copy Link
Copy Doc ID a26371c3-75fd-11ea-9384-00505692583a:192224

General limitations

FortiConverter is a migration tool, not a migration service. It’s designed to be used as part of a properly planned migration process.

Supported FortiOS conversions

FortiConverter supports conversions from other vendors to FortiOS 6.0 and 6.2 only.

Creating final configurations

While FortiConverter significantly shortens the conversion process, a final, useable configuration requires you to review and audit the FortiConverter output conversion. The FortiConverter tuning capability can help with the review and audit process.

While you can use the FortiConverter tuning capability to review and fix errors in the conversion, it isn't designed to perform significant reconfiguration.

Incomplete routing information

In some cases, not all routing information that FortiConverter requires to make a decision about a policy interface is available. In these cases, it uses the any interface.

Double NAT

For Check Point conversions, the FortiConverter conversion engine uses a manual rule to convert configurations that apply source NAT and destination NAT to the same policy (called double NAT).

For all other conversions, FortiConverter NAT merge doesn't support double NAT. Instead, FortiConverter applies source NAT in the conversion and you complete the configuration by using the tuning page to manually apply destination NAT.

IPsec support

FortiConverter converts IPsec configurations to route-based or policy-based IPsec depending on which one the source configuration is closest to. Users can enable Route-based IPSec for Cisco ASA, PIX,FWSM, Juniper and Check Point conversions.

General limitations

FortiConverter is a migration tool, not a migration service. It’s designed to be used as part of a properly planned migration process.

Supported FortiOS conversions

FortiConverter supports conversions from other vendors to FortiOS 6.0 and 6.2 only.

Creating final configurations

While FortiConverter significantly shortens the conversion process, a final, useable configuration requires you to review and audit the FortiConverter output conversion. The FortiConverter tuning capability can help with the review and audit process.

While you can use the FortiConverter tuning capability to review and fix errors in the conversion, it isn't designed to perform significant reconfiguration.

Incomplete routing information

In some cases, not all routing information that FortiConverter requires to make a decision about a policy interface is available. In these cases, it uses the any interface.

Double NAT

For Check Point conversions, the FortiConverter conversion engine uses a manual rule to convert configurations that apply source NAT and destination NAT to the same policy (called double NAT).

For all other conversions, FortiConverter NAT merge doesn't support double NAT. Instead, FortiConverter applies source NAT in the conversion and you complete the configuration by using the tuning page to manually apply destination NAT.

IPsec support

FortiConverter converts IPsec configurations to route-based or policy-based IPsec depending on which one the source configuration is closest to. Users can enable Route-based IPSec for Cisco ASA, PIX,FWSM, Juniper and Check Point conversions.