Forcepoint Start options
The following table lists the start settings.
| Setting | Description |
|---|---|
| Profile | |
| Description | Enter a description of the configuration. |
| Output Options | |
| Output Format | Select the appropriate output for your target Fortinet device. |
| FOS Version | The configuration syntax is slightly different among FortiOS 6.4, 7.0, 7.2, and 7.4. Select the version that corresponds to the FortiOS version on the target. |
| Input | |
| Source Configuration | Select the input file. |
|
Bulk Conversion |
If there are many devices to be converted where all of them are the same model, sharing the same interface mapping relationship in conversion, then bulk conversion can convert all of them at once. Collect all the configuration files to be converted, compress them into a ZIP file and use the ZIP file as the input. |
|
Target device (Optional) |
|
|
Target device |
Select the model of the target device, or select a device connected to FortiConverter. |
| Conversion Options | |
| Discard unreferenced firewall objects | Specifies whether addresses and services that aren't referenced by a policy are saved and added to the output. This option can be useful if your target device has table size limitations. You can view the unreferenced objects that FortiConverter removed on the Tuning page. |
| Increase Address and Service Table Sizes for High-End Models | You can customize the maximum table sizes that FortiConverter uses when Adjust table sizes is selected. For more information, see Adjusting table sizes. |
|
Automatically generate policy interfaces (Stonesoft only) |
Specifies whether FortiConverter automatically generates policy interfaces. |
|
Policy index start from 1 instead of 10000 |
When selected, the serial number of firewall policies will start from 1 instead of 10000. |
|
Split Address group From VPN Phase2 selector (Sidewinder only) |
If the remote side of the VPN is not a FortiGate but a device of another vendor, setting an address group in the VPN phase2 quick selector does not work. When this option is enabled, a VPN phase2 object with an address group in the selector would be split into multiple objects with a subnet or a range in the selector. |
|
NGFW policy-based mode |
When selected, the conversion will be in NGFW policy-based mode. " |
|
Remove self-traffic addresses and policies |
Self-traffic polices, which use the address "Firebox" as source or destination address, are not necessary in FortiOS. FortiConverter comments out the self-traffics policies or remove self-traffic addresses from policies when this option is enabled. |
| Nat Merge Options (Stonesoft Only) | |
| Ignore firewall policies with all or any addresses when processing NAT rules | Specifies whether FortiConverter ignores firewall policies with an "all" or "any" address when it merges a NAT rule and a firewall policy to create a FortiGate NAT policy. FortiConverter creates new policies in the output configuration based on where NAT rules to firewall policies intersect. Because firewall policies that use "all" or "any" as the address create many intersections, Fortinet recommends that you ignore them. |
| Enable central NAT merge | Specifies whether FortiConverter converts NATs to FortiGate central NATs instead of policy-based NATs. It is recommended to enable this option. |
| Comment Options | |
|
Policy comment - Preserve the original comment |
Include the original comment in source file in the comment of the output policy. |