Overview

This document applies to FortiNAC appliances configured for High Availability. Provides the steps for a customer to migrate their existing FortiNAC Control (FNC-C-VM) and Application (FNC-A-VM) virtual appliance pair to the new FortiNAC-F virtual appliance (FNC-CAX-VM). The FNC-C-VM and FNC-A-VM pair use the CentOS operating system. The FNC-CAX-VM uses the FortiNAC-OS operating system. This document assumes the customer is using perpetual endpoint licenses.

Once migration is complete, the FortiNAC-OS appliance will have the license, entitlements and configuration of the CentOS appliance pair.

If managed by a FortiNAC Manager, do not use this document. Proceed to: Separate C+A to FortiNAC-OS VM Migration - FortiNAC Manager Environments

Requirements

• The FortiNAC Primary Server must be using perpetual endpoint licenses (Support Type = License Support). To confirm, login to the Customer Portal (https://support.fortinet.com) and review the Entitlements section for the Control Server.

• Contact sales to obtain the new FortiNAC-F appliances (FNC-CAX-xx/FNC-MX-xx). Registration codes for the new product will then be sent via email.

• Both FortiNAC servers must match all of the following:

  • Model (FNC-CAX-VM, FNC-CA-500F, FNC-CA-600F , FNC-CA-700F, FNC-MX-VM, FNC-M-550F)

  • Virtual Appliance Vendor (Hyper-V, AWS, Azure, etc)

    See chart below for examples.

    Previously, the FortiNAC "C" Series (CentOS operating system) used a .bin install file specific to the software version for software upgrades. This file was used for all appliance types.

    The FortiNAC "F" series (FortiNAC-OS operating system) uses a .out image file that combines the Software and OS updates. These .out files are specific to the software version and appliance type (virtual appliance vendor or physical hardware model).

    Examples

    FNAC_AWS-v7.4.0-build0427-FORTINET.out (VM (AWS) FortiNAC vF7.4.0.0427)

    FNAC_AZU-v7.4.0-build0427-FORTINET.out (VM (Azure) FortiNAC vF7.4.0.0427)

    FNAC_CA_500F-v7.4.0-build0427-FORTINET.out (Hardware CA (500F) FortiNAC vF7.4.0.0427)

    FNAC_CA_600F-v7.4.0-build0427-FORTINET.out (Hardware CA (600F) FortiNAC vF7.4.0.0427)

    To upgrade, the primary server downloads the .out update file applicable to its appliance type and copies it to the secondary. If FortiNAC-F servers are mixed within the HA pair, the primary server will not have the required .out file for the secondary. As a result, the secondary server will not update.

    Configuration Example – High Availability Pair

    Supported (Primary/Secondary)	Not Supported (Primary/Secondary)
    FNC-CA-500F / FNC-CA-500F FNC-CAX-VM (AWS) / FNC-CAX-VM (AWS) FNC-M-550F / FNC-M-550F FNC-MX-VM (VMware) / FNC-MX-VM (VMware)	FNC-CA-500F / FNC-CA-600F FNC-CAX-VM / FNC-CA-xxxF FNC-CAX-VM / FNC-CA-VM FNC-CAX-VM (AWS) / FNC-CAX-VM (KVM) FNC-MX-VM / FNC-M-550F FNC-MX-VM (VMware) / FNC-MX-VM (AWS)

• Recommended FortiNAC software versions

  • Existing FortiNAC CentOS appliances

    • v9.1 or greater* **

    • vF7.2.0 or greater * **

      * Later versions may require importing of key certificates prior to upgrade. See Importing License Key Certificates.

      ** Later versions may require new license keys prior to upgrade. See KB article Upgrade fails with license requirement error)

  • New FortiNAC-OS appliances: F7.2.5 or greater

• Temporary management IP address

• CLI access to both the CentOS and FortiNAC-OS appliances

Considerations

The process outlined and the tools used for this migration is not supported for the following:

• FortiNAC systems using subscription endpoint licenses (Support Type = FortiNAC VM)

• FortiNAC-OS appliances running F7.2.5:

  • "Portal" and "Persistent Agent" SSL certificates will not be migrated. These certificates will have to be installed post migration. Reference Ticket # 988244 in the Known Issues section of version 7.2.5 Release Notes.

  • Migration script fails to bundle on Control and Application server pairs configured for High Availability. Reference Ticket # 990531 in the Known Issues section of version 7.2.5 Release Notes.

Migration Steps

Below are the steps required to complete the migration.

Step 1: Product Registration*

Step 2: Transfer Endpoint License Entitlements*

Step 3: Appliance Installation

Step 4: Generate and Download Keys

Step 5: Appliance Configuration

Step 6: Download & Install New License Key

--- PERFORM REMAINING STEPS DURING MAINTENANCE WINDOW* ---

Step 7: Collect & Transfer CentOS Migration Data

Step 8: Cutover to New Appliance

*See Preparation Checklist for suggested timelines to complete step.