Manual Configuration Migration Prerequisite

Some configurations cannot be converted by FortiConverter but need to be configured manually. Please follow the steps below to import certificates and migrate FortiToken to new device.

Import your Certificate

Before importing the certificate, please prepare either your certificate (.crt) and private key (.key), or the PKCS#12 certificate (.pfx).

Steps to import the signed certificate into your FortiGate:

1. Log in to your FortiGate unit and go to System > Certificates.

If there’s no Certificates, please click Feature Visibility and enable the Certificates.

2. Click Import > Local Certificate.
3. Upload the local certificate file and private key, then click OK.

If you use a password to encrypt the certificate file, please fill the password as well.



4. The certificate will be added and the status of the certificate will change from PENDING to OK.

FortiGate provides the capability to download the certificate. However, for security reasons, the private key encrypted in FortiGate cannot be accessed. To successfully restore the private key, you need to find the matched origin key to import the certificate to another FortiGate device.

Migrate FortiToken

To import the FortiToken Hardware into your FortiGate:

1. Export the FortiToken config from the old device and import the config to the new device. The config can be output in the CLI console by the commands:

"config user fortitoken" -> "show".

2. Remove the FortiTokens from the old device, or block the access of the old device to FortiGuard. This would prevent the old device from requesting the activation of the tokens after they are reset.
3. Reset the activation flags for the tokens through FortiCare.

Create a FortiCare ticket on the Support Portal https://support.fortinet.com/, and ask TAC to help you reset the activation flags of the FortiTokens. The message should include the SN of the old device and the FortiTokens.

The TAC would reset the activation flag and inform you after it is completed.

4. Connect the new device to FortiGuard, and the tokens would be activated.

To import the FortiToken into your FortiGate:

1. Transfer the FortiToken license from the old device SN to the new device SN through FortiCare.

Create a FortiCare ticket on the Support Portal https://support.fortinet.com/, and ask TAC to help you migrate the FortiTokens from the old device to the new device. The message should include the SN of the old device, the new device, and the FortiTokens.

The TAC would migrate the token and inform you after the migration is completed.

2. Activate the FortiToken on the new device.

Go to the page User & Authentication > FortiTokens on the new device. Click Create New and input the activation code of the FortiTokens. The tokens would be imported into the new device.

3. Re-provision every user, which means to bind a new token to user’s app again.

Configure users on the new device, send the activation code through e-mails or SMS to do re-provision for all users, and the migration is completed. The seeds on the old device cannot be restored to the new device. This is designed to prevent possible fraudulent attacks.