Cisco ASA to Fortigate conversion

I'm getting ready to migrate a number of Cisco ASA firewalls to Fortigate.
Fortinet sells a ~$4000 license for their FortiConverter which I didn't want to spend.

My goal was to automate the conversion of objects which will save time and virtually eliminate the possibility of typos.

The below perl script is what I came up with.

-Syntax: "perl converter.pl <ASA config file name>" (e.g. "perl converter.pl running-config.cg")
-Script converts hosts, networks and ip ranges
-Script does NOT convert or create group objects (someone want to add that for me?)

Once run all that's left to do is remove all the miscellaneous Cisco commands, import the config (via GUI or CLI) and within a couple of minutes you have all the objects ready for use in creating policies.

Happy New Year :)


#!/usr/bin/perl

# Requires Net::Netmask module

use strict;
use warnings;
use Net::Netmask;

$^I = '.bak'; # create a backup copy

BEGIN {undef $/;}

while (<>) {
# match host objects in groups
   s/network\-object host ((?:\d{1,3}\.){3}\d{1,3})/config firewall address\redit h-$1\rset subnet $1 255.255.255.255\rnext\rend/g; # do the replacement
 
# match network objects in groups
   s/network\-object ((?:\d{1,3}\.){3}\d{1,3})\s(.*)/"config firewall address\redit n-$1\/".Net::Netmask->new("0.0.0.0", $2)->bits."\rset subnet $1 $2\rnext\rend"/ge;
 
# match host objects with descriptions
   s/object network.*\s*host ((?:\d{1,3}\.){3}\d{1,3})\s*description\s(.*)/config firewall address\redit h-$1\rset comment $2\rset subnet $1 255.255.255.255\rnext\rend/g;
 
# match host objects without descriptions
   s/object network.*\s*host ((?:\d{1,3}\.){3}\d{1,3})/config firewall address\redit h-$1\rset subnet $1 255.255.255.255\rnext\rend/g;
 
# match subnet objects with descriptions
   s/object network.*\s*subnet ((?:\d{1,3}\.){3}\d{1,3})\W(.*)\s*description\s(.*)/"config firewall address\redit n-$1\/".Net::Netmask->new("0.0.0.0", $2)->bits."\rset comment $3\rset subnet $1 $2\rnext\rend"/ge;
 
# match subnet objects without descriptions
   s/object network.*\s*subnet ((?:\d{1,3}\.){3}\d{1,3})\W(.*)/"config firewall address\redit n-$1\/".Net::Netmask->new("0.0.0.0", $2)->bits."\rset subnet $1 $2\rnext\rend"/ge;
 
# match range objects with descriptions  
   s/object network\s.*\s*range ((?:\d{1,3}\.){3}\d{1,3})\W(.*)\s*description\s(.*)/config firewall address\redit r-$1-$2\rset comment $3\rset type iprange\rset start-ip $1\rset end-ip $2\rnext\rend/g;
 
# match range objects without descriptions
   s/object network.*\s*range ((?:\d{1,3}\.){3}\d{1,3})\s(.*)/config firewall address\redit r-$1-$2\rset type iprange\rset start-ip $1\rset end-ip $2\rnext\rend/g;
 
# remove leftover network group names with descriptions
   s/object\-group.*\s*description.*//g;
 
# remove leftover network group names without descriptions
   s/object\-group.*//g;
 
# remove references to existing network objects
   s/network-object object.*//g;

 print; # print to the modified file
}

How-to: Automatically revert a config on a FortiGate

There's nothing worse than remotely configuring a firewall and then loosing access once you've made your changes. Having a failsafe mechanism in place to revert to a previous config automatically will help you minimise potential issues and save you alot of stress! Luckily FortiOS gives you a few options on how to save your running config which we'll discuss below.

We'll go through each of the three options available. Each one is configured via the CLI.

1. Automatic
2. Manual
3. Revert

1. Automatic

This is the default setting. The FortiGate will automatically save it's running config to the start-up config every time you make a change by typing 'end' in the CLI or clicking Ok/Apply in the GUI.

config system global
set cfg-save automatic
end

2. Manual

In Manual mode, your changes will take effect immediately (saved to the running config) but will be lost on a reboot unless a special save command is given (the running config will then be saved to the startup config).

config system global
set cfg-save manual
end

To save your changes to the startup config use the following command:

execute cfg save

3. Revert

Revert mode will start a countdown timer as soon as you've made a change. If you don't save the config before the countdown timer has ended then the unit will automatically reboot and load the startup config (ie: all your changes will be lost).

This is perfect if you're doing remote administration. If you make a change that locks you out, just wait until the timer has restarted then the firewall will reboot with your previous config.

config system global
set cfg-save revert
set cfg-revert-timeout 300
end

The cfg-revert-timeout variable is the countdown timer in seconds. The default is 600 seconds (10 minutes).

To save your changes to the startup config use the following command:

execute cfg save

One word of warning: You will not see any countdown timers via SSH/Telnet or the WebGUI. You can only see these timers if you've connected to the device via console. The countdown starts warning you from 10 seconds, so you need to be quick!


(credit: Al's Tech Corner)