Alcatel-Lucent Conversion

Alcatel-Lucent differences

Conversion support

FortiConverter supports the conversion of the following Alcatel-Lucent Brick features:

• Interfaces
• Host Groups
• Service Groups
• Zone Brick Rulesets

Fortinet plans to support the following Lucent features in a future FortiConverter release:

• NAT
• Schedule
• VPN
• Hosts Behind Zone

Address and address group configuration

• Lucent host addresses are mapped to FortiGate addresses.
• Lucent host groups are mapped to FortiGate address groups.
• Virtual Brick Addresses (VBA) aren't supported.

Interface configuration

• FortiConverter assigns default VLAN configuration directly to physical interfaces.
• FortiConverter considers all VLANs named "*" or "Port Default" to be the default VLAN configuration.
• Domain Addresses aren't supported.

Service and Service Group configuration

• Lucent Service Groups are mapped to FortiGate Service Groups.
• Lucent service "*" maps to FortiGate service "any".

Policy configuration

Lucent Brick Zone Rulesets operate at the zone level, which has no direct equivalent in FortiGate. Zone rulesets need to be translated into equivalent FortiGate policies.

FortiConverter translates Lucent Brick rules by separating traffic into two categories: inter-partition and intra-partition.

• Inter-partition traffic behaves like inter-VDOM traffic, and is simple to convert to FortiGate policies.
• Intra-partition traffic is more complicated to convert because multiple zone rules can be applied.

FortiConverter handles the inter-partition traffic by creating a general policy for each rule.

FortiConverter handles the intra-partition traffic by looking for all matches between two zone rulesets. FortiConverter looks at 3 fields: source, destination, and service. All 3 fields must overlap for the rules to match. FortiConverter creates a policy for each match using the intersection of each field.

The action of the rules determines the action of the converted policy, as shown in the following table:

Rule 1	Rule 2	Policy
Pass	Pass	Accept
Pass	Drop	Deny
Drop	Pass	Deny
Drop	Drop	Deny

Inter-partition Deny policies have higher priority than intra-partition policies, while inter-partition Accept policies have lower priority than intra-partition policies.

Lucent default ruleset "firewall" is currently unsupported.

VDOM configuration

• Lucent partitions map to FortiGate VDOMs.
• VDOM names are limited to 11 characters. FortiConverter truncates longer names to 11 characters.
• Lucent partition "*Default" maps to the FortiGate root VDOM.

Example conversion

The following block diagram and tables illustrates a Lucent configuration with 2 partitions and 3 zones.

Zone eth0 Ruleset
Rule Num	Direction	Source	Destination	Service	Action
1000	Out	192.168.1.15	172.30.10.1/24	*	Drop
1001	Both	192.168.1.0/24	172.30.10.1/24	*	Pass

Zone eth1 Ruleset
Rule Num	Direction	Source	Destination	Service	Action
1000	In	*	172.30.10.5 - 172.30.10.20	TCP	Pass
1001	Both	192.168.1.132	172.30.10.9	*	Pass

Zone eth2 Ruleset
Rule Num	Direction	Source	Destination	Service	Action
1000	Both	*	10.10.15.0/24	HTTP	Pass

This Lucent configuration creates the following FortiGate configuration. Inter-partition rules are in bold.

VDOM lab-hosts Policies
Policy Num	Src Interface	Dst Interface	Source	Destination	Service	Action
10000	eth0	any	192.168.1.15	172.30.10.1/24	*	Deny
10001	eth0	eth1	192.168.1.0/24	172.30.10.5 - 172.30.10.20	TCP	Accept
10002	eth0	eth1	192.168.1.132	172.30.10.9	*	Accept
10003	eth0	any	192.168.1.0/24	172.30.10.1/24	*	Accept
10004	any	eth0	192.168.1.0/24	172.30.10.1/24	*	Accept
10005	eth1	eth0	192.168.1.132	172.30.10.9	*	Accept
10006	eth1	any	192.168.1.132	172.30.10.9	*	Accept
10007	any	eth1	192.168.1.132	172.30.10.9	*	Accept

VDOM office-hosts Policies
Policy Num	Src Interface	Dst Interface	Source	Destination	Service	Action
10000	any	eth2	any	10.10.15.0/24	HTTP	Accept
10001	eth2	any	10.10.15.0/24	any	TCP	Accept