Firewall migration to FortiGate: rules, VPN and downtime

A firewall migration to FortiGate means moving the rules, VPN tunnels and internet-facing services from the old device to the new one. After the switchover, the office should work just as it did before. Downtime is limited to the switchover and the checklist tests, because we do most of the work before the maintenance window: we tidy up the rules and prepare the configuration and a fallback plan.

We are an authorised Fortinet partner. Model selection, licences and maintenance are covered on our Fortinet FortiGate firewall deployment page. The migration itself comes down to three questions: what to move, how to keep the interruption short and when to go back to the old device.

What we move from the old firewall

An old firewall usually does more than anyone remembers. Before we start, we list everything that passes through it or runs on it:

• traffic rules between networks and to the internet
• port forwarding, meaning services reachable from outside (email, remote desktop, cameras, line-of-business systems)
• VPN tunnels to branches, suppliers and partners
• VPN for remote staff, with the accounts and the sign-in method
• VLANs, static routes and sometimes a DHCP and DNS server
• the public addresses from the provider and what each one is used for

A configuration from another manufacturer’s device cannot simply be loaded onto a FortiGate. Each manufacturer describes objects, address translation and VPNs differently. We therefore rewrite the rules and check them one by one, using our own methods for moving configurations and, where needed, working with the manufacturer.

Tidying up the rules before migration

A migration is the best moment to tidy up, because every rule has to be reviewed anyway. For each one we ask who needs it and why. If the old device shows hit counters, we check whether the rule is used at all.

Rules with no owner and no traffic do not go onto the new device. Any-to-any rules are replaced with specific ones: source, destination and port. If it is unclear whether a rule is needed, we move it with logging enabled and review it after a few weeks.

Along the way, we find things to fix regardless of the firewall. Typical examples are open remote desktop ports, VPN accounts of former staff and devices with default passwords.

VPN in a FortiGate migration: SSL VPN or IPsec?

For new deployments, we design staff VPN on IPsec. Fortinet has announced that from FortiOS 7.6.3, SSL VPN tunnel mode is replaced by IPsec VPN on all FortiGate models (FortiOS 7.6 release notes, as of 14 September 2026). The SSL VPN tunnel mode configuration is not carried over on upgrade and has to be moved to IPsec before the upgrade.

For a migration, this means two things:

• if your old firewall has an SSL-based VPN, we build it on IPsec on the FortiGate from the start
• every staff laptop gets a new VPN client configuration, so we send it out before switchover day

Tunnels to branches and partners need agreement with the other side. If the public address or encryption parameters change, the administrator at the other end has to change their configuration in the same window.

Maintenance window and downtime

We plan the switchover outside business hours. Before the maintenance window, we agree three things with you: when it happens, who from your company is on call and which systems must work first thing in the morning.

During the switchover, internet access, VPN and internet-facing services stop working. We warn staff in advance, as well as partners who connect to your network. If the public addresses change, we lower the DNS TTLs beforehand so the new addresses take effect quickly.

Downtime usually lasts from 30 minutes to 2 hours. We test the key functions on the new device before the window to keep the interruption as short as possible.

Before the window, we have ready:

• a FortiGate configuration tested on the bench before the device goes into the rack
• a backup of the old device’s configuration
• console access to both devices and a contact at the internet provider
• a list of tests to run after the switchover

Tests after the switchover

After the switchover, we check every service on the list, including those the company uses rarely. We test internet-facing services from outside the company network, for example from a phone on mobile data.

What we check	How
Internet in every network	a computer on the staff network, guest Wi-Fi, the device network
Servers and line-of-business systems	signing in to the accounting software, access to network shares
Printing and scanning	a printout and a scan to a folder or email
Internet-facing services	a connection from outside the company network to each published service
Staff VPN	a connection from a laptop outside the office
Branch tunnels	access from a branch to the servers at head office
Telephony	an incoming and an outgoing call

Over the following days, we read the FortiGate logs and look for traffic that the new rules block but someone in the company needs.

Fallback plan: when we go back to the old device

We agree the fallback plan before the maintenance window. We decide which services are critical and the time by which they must work. If something critical does not work by then, we reconnect the old device and return to the previous state.

We do not fix problems on a live network under time pressure. We analyse the fault calmly and set a new window. That is why the old firewall stays next to the new one for a while after the migration, with its full configuration.

What drives the time and cost of a migration

We quote a migration individually, as a fixed price for the project. The time and price depend on:

Factor	Why it changes the cost
Number of rules and how well they are documented	undocumented rules have to be explained before we move them
Number of sites	each office means a separate device, connection and VPN tunnel
Staff VPN	a new configuration on every laptop
Splitting the network into zones	changes on switches and Wi-Fi
Maintenance window	work outside business hours

Hardware and FortiGuard subscriptions are quoted separately, at current Fortinet prices. Our cybersecurity services page covers network protection in more detail.

A firewall is one layer of protection. Our article on threat monitoring and incident response explains how to detect attacks that get past it. Every migration starts with a list of what your current firewall does. Send us its model and the number of sites, and we will prepare that list with you.