Select this option if the configuration is from a SmartCenter with version R80.10 or later device.

Select this option if the configuration is an archived JSON file exported from the Check Point “ShowPolicyPackage” tool.

Select the policy information file. This file should include the policy informations and manual NAT rules in each policy package. This is only needed for devices with SmartCenter version before R80.

Select the policy file in CSV format. This is only needed when "R80.10 or later" is selected.

Select the NAT rule file in CSV format. This is only needed when "R80.10 or later" is selected.

Select the identity role file. (SmartCenter only)

Select the result text file from linux command "ifconfig" output.

The file would help to determine the vlan-id of interfaces if provided.

Select the model of the target device, or select a device connected to FortiConverter.

This option can be useful if your target device has table size limitations.

You can view the unreferenced objects that FortiConverter removed on the Tuning page.

FortiConverter can distinguish global objects in the configuration and output the converted global objects into a separated file.

Self-traffic polices should be configured in Check Point, but they are not necessary in FortiOS. FortiConverter comments out the self-traffics policies or remove self-traffic addresses from policies when this option is enabled.

When selected, the serial number of firewall policies will start from 1 instead of 10000.

If the remote side of VPN is not a FortiGate but a device of other vendor, setting an address group in the VPN phase2 quick selector does not work. When this option is enabled, a VPN phase2 object with an address group in the selector would be split into multiple objects with subnet or a range in selector.

Fet the routing information from the source configuration file instead from nstats command

Adds "v-" prefix to the name if an address would be referenced in a VIP.

When selected, the conversion will be in NGFW policy-based mode.

"firewall policy" will become "firewall security-policy" instead, and "set application 00000" will be generated in policies, which requires manual processing. There will also be some other minor differences adapted for the NGFW policy-based CLI.

When a policy has action "inner layer", and its child has src/dst address as "any", the policy’s address will apply to the child’s.

Add "set arp-reply disable" for all IPPool and VIPs

Specifies which types of NAT FortiConverter merges with the output firewall policies, or whether FortiConverter performs NAT merge based on object names or values.

• Off – FortiConverter converts firewall policies only and doesn't perform NAT merge for this type of NAT. This is useful for performing a quick, initial conversion to discover any conversion issues.
• Object Names – FortiConverter performs NAT merge based on matching address names in firewall policies and NAT rules.
• Object Values – FortiConverter performs NAT merge based on matching address values in firewall policies and NAT rules. It generates the most accurate matching of NAT rules and policies, but in most cases, it also generates more NAT policies.

Because it can take FortiConverter several hours to complete a conversion that include a large number of NAT rules, Fortinet recommends that you turn off or limit NAT merge for your initial conversion. Then, resolve any issues with the conversion before you run it again with NAT merge enabled. For more information, including example matches, see NAT merge options.

When this option is enabled (in policy NAT mode only), a static NAT rule would be converted into a central SNAT rule and an unidirectional VIP object. Otherwise it would be converted into a bidirectional VIP object

Append the policy UUID given in the Check Point source config as part of policy comments to make it easier to correlate source and converted policies .