Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I have recently been tasked with doing a firewall migration from an old NetScreen NS500 box to a FortiGate device (I believe it will be a 60C). I am sure most of you aware that NetScreen boxes are no longer sold since Juniper took over, so finding documentation has been a little difficult for me. Basically, I am wondering if anyone has any advice or possibly tools to help with this migration process. Doing this manually is proving to be a nightmare!

Note that I have tried https://convert.fortinet.com however it does not support this old NetScreen config, but it does support the newer Juniper configs. If there was someway of going NetScreen -> Juniper that would allow me to use the FortiConverter, but that also means another step which inherently means that I will incur more variation/errors in the migration process.

Let me know what you guys think, really any advice at all would be good at this point.

share|improve this question
Sorry, I may be incorrect in saying that the NetScreen boxes are not sold/supported (etc). A collegue mentioned this to me but now Google has me doubting myself. Regardless, the main question still stands. Thanks. – giygas73 Aug 16 '12 at 13:55
I think this might be far too localized to get many answers. – schroeder Aug 16 '12 at 16:45
Sorry, I was not aware that localization was an issue here. Maybe I should change the question to just deal with general firewall migration? What do you think? – giygas73 Aug 16 '12 at 18:35
Hi @giygas73, welcome to IT Security. This is bordering on "too localized", asking about migrating between those two specific products. But more importantly, this also sounds like a technical, sysadmin-focused task, which would be more ontopic at Server Fault. However, if you do change the question to deal with firewall migration in general - I think that would be a fantastic question here. – AviD♦ Aug 18 '12 at 20:16

closed as off topic by schroeder, Iszi, Gilles, bethlakshmi, Terry Chia Sep 12 '12 at 4:17

Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

3 Answers

up vote 2 down vote

If I were you, I'd try posting in the Juniper forums and the Fortinet forums.

When you running old, unsupported versions, the vendor usually doesn't want to know, especially when you're moving from them. However, if you have a support contract with Fortinet (sorry I'm not familiar with them much), I'd have thought that your Account Manager would've been helpful?

Regarding general firewall migrations, 9 times out of 10, I found manual to be better, although more tedious. When the upgrade was version upgrade within the same product line, it was much easier and straight-forward with the latest version/package from the vendor. Otherwise it was more painful and required copying each rule over (taking notes for the 5-tuple and any other information).

Good luck!

share|improve this answer
up vote 0 down vote

Try two steps process, There might be support from juniper or in forums to migrate from older netscreen to latest netscreen configs and from latest netscreen config to fortinet .

This requires rigorous testing though for correctness

share|improve this answer
up vote 2 down vote

I would support the manual approach @MarkHillick mentioned. I have helped organisations (one with over 600 firewalls and many thousand rules) migrate to new firewalls, and the only way to do it which provides review, auditability, checks on ownership of rules and a straightforward backout plan is to do this manually.

It takes time, but trying to automate the process of moving from a legacy rulebase is likely to not only propagate existing weaknesses, but introduce more.

share|improve this answer
Have to upvote someone when they agree with me :) Manual is tedious but it's amazing how many redundant rules and objects that one can find - great form of clean-up! – Mark Hillick Aug 17 '12 at 19:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.