> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/migrations/how-to/como-migrar-un-fortigate-desde-on-premise-a-cloud.md).
# How to Migrate a FortiGate from On-premise to Cloud
Migrating a FortiGate from on-premises or from another cloud to Plenit doesn't have to be a complex project.
If you have the active license and the exported configuration, the process is reduced to deploying a new FortiGate on the platform and restoring your configuration on top of it.
> ๐ What you get
>
> Your firewall in Plenit with the same policies, routes, and VPNs you were already using, ready to operate from the cloud.
### What you need before you start
* **Active FortiGate license**: confirm that it can be transferred or activated in the new virtual instance.
* **Administrative access** to the source FortiGate (GUI or CLI) to export the configuration.
* **Firmware version**: ideally, the target FortiOS in Plenit should be equal to or newer than the source device's.
* A **inventory** of interfaces, routes, NATs, VPNs, network objects and certificates, to check afterwards that everything has been migrated.
### Step 1. Export the configuration from the source FortiGate
#### 1.1 From the GUI
In the FortiGate web administration, go to **Configuration โ Backup/Export**, export the full configuration (or each VDOM if applicable) and save the file `.conf` or `.yaml`.
{/\* ๐ธ CAPTURE 1 ยท source FortiGate ยท Backup/Export menu and .conf/.yaml formats \*/}
#### 1.2 From the CLI
If you prefer the console, the equivalent is:
```bash
execute backup config flash backup.conf
```
This saves the full configuration in a file that you then download.
### Step 2. Deploy a FortiGate in Plenit
Create a new instance following [How to deploy a FortiGate VNF in Plenit](https://gitlab.com/plenit-group/plenit-docs-es-es/-/blob/v1.0/docs/Productos/servicios-cloud-migraciones/servicios-cloud-migraciones-how-to/servicios-cloud-servidores-desplegar-fortigate-vnf/README.md): name, region and zone, resources, image **FortiGate** from the Marketplace and networking (Direct IP for management + L2 for the internal network).
> ๐ Size for production
>
> For a migration with the full configuration, size with headroom (for example 4 vCPU and 8 GB of RAM). Keep in mind that the VNF's main disk is fixed at 2 GB by the manufacturer: the large space you need is added as **additional disk**.
{/\* ๐ธ CAPTURE 2 ยท deployment of the FortiGate in Plenit (resources/image/network) \*/}
### Step 3. Migrate the license
The new FortiGate needs an active license to operate with all its features:
* If your license is of type **virtual (VM)**, activate it on the new server.
* If it was associated with **hardware**, contact Fortinet to transfer it.
The **Full** option gives you access to all features; the trial version requires a FortiCare account and can only be associated with a single device.
{/\* ๐ธ CAPTURE 3 ยท license selection (Full / trial) \*/}
### Step 4. Import the configuration
With the FortiGate in Plenit already operational:
1. Access its GUI (for example, `https://IP:8443`).
2. Go to **Restore / Import Configuration**.
3. Upload the file `.conf` (or `.yaml`) that you exported.
4. Apply and reboot.
> โ๏ธ Reboot is mandatory
>
> The configuration is not applied until you reboot the device. The file password is optional: if you exported without a password, leave that field blank.
{/\* ๐ธ CAPTURE 4 ยท Restore/Import screen with the file loaded \*/}
> ๐ง Check that the interfaces match
>
> Compare the interfaces in the source file with those of the new instance. If they differ (for example, in the port names), adjust them manually before considering the migration successful.
### Step 5. Verify operation
Check that the VPNs are up, that the firewall and NAT policies behave as in the original, and that the internal network has connectivity in both directions. Review logs and alerts, and validate that HTTPS and SSH management responds on the configured ports.
From the terminal, confirm that management responds:
```shell
curl -kI https://:8443
ssh admin@ -p 2022
```
And from the FortiGate CLI itself, check VPNs and routes:
```shell
get vpn ipsec tunnel summary
get router info routing-table all
```
### Step 6. Final adjustments
* **Certificates**: import the ones you used for VPN or secure administration.
* **Backups**: schedule automatic configuration backups so you don't lose future changes.
* **Security**: restrict management access by IP, change the default ports, and review users.
* **Monitoring**: enable SNMP (if you didn't do it during deployment) to have metrics in the Plenit dashboard.
### Conclusion
Migrating a FortiGate to Plenit is a straightforward process when you prepare two things well: the license and the exported configuration. With that, in just a few steps you have in the cloud the same firewall you were already operating, with its policies, routes and VPNs intact, and you gain the scalability and visibility of the platform.
The place where it's worth not rushing is the interface check: if the port names change between source and destination, that manual adjustment is what separates a migration that works from one that seems migrated but doesn't route.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.plenit.com/docs-en/productos/migrations/how-to/como-migrar-un-fortigate-desde-on-premise-a-cloud.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.