From Fortinet FortiGate to OPNsense
FortiGates are powerful, but tied to security bundles and support contracts. On top of that, there have been repeatedly exploited vulnerabilities in the SSL VPN, listed by the US agency CISA in its catalogue of known exploited vulnerabilities. Many operators are therefore asking the fundamental question.
At a glance
- Source
- Fortinet FortiGate
- Target
- OPNsense Business Edition
- Cutover
- usually 1–2 hours
- Fallback
- until sign-off
Starting point
Why operators switch
With FortiGates, IPS, web filtering and application control depend on bundles that are renewed annually. Hardware generation and licence term are closely linked. If you are facing a renewal anyway, it is worth making the comparison.
Typical reasons
- annual bundle costs for features that OPNsense provides at no extra cost
- coupling of hardware lifecycle and licence
- recurring emergency patches for the SSL VPN
- preference for open code and a European vendor
Features
What becomes of your Fortinet FortiGate features
| Fortinet FortiGate | OPNsense | Note |
|---|---|---|
| Address objects, groups | Aliases | including FQDN objects |
| Policies (interface pairs) | Interface rules, floating rules | logic is translated |
| VIPs (DNAT) | Port forward, 1:1 NAT | fully supported |
| IPS | Suricata IPS | ET Open, optional commercial |
| Web Filter, App Control | Zenarmor or proxy categories | policies are rebuilt |
| SSL VPN, FortiClient | WireGuard or OpenVPN with 2FA | new clients with profiles |
| IPsec site-to-site | IPsec (IKEv2) | agree parameters with peers |
| SD-WAN | Gateway groups, multi-WAN, policy-based routing | failover and load balancing |
| HA (FGCP) | CARP cluster with state sync | maintenance without interruption |
| FortiManager, FortiAnalyzer | OPNcentral, API, syslog to SIEM | different concept, same goal |
| Security Fabric | – | no direct equivalent |
Approach
How we migrate
Process
- Export of the FortiOS configuration, analysis of policy hits
- Clean-up of unused policies and objects
- Translation of objects, policies, VIPs and VPNs
- Rebuild of web and application filtering
- Sizing based on real throughput
- Cutover in a maintenance window, FortiGate as fallback
- Follow-up support and documentation
What to watch out for
- Hardware acceleration: FortiGates use ASICs. We size for your throughput with IPS enabled, not according to the data sheet.
- Zone logic: policies apply between interface pairs, while OPNsense evaluates inbound per interface.
- FortiToken: 2FA is switched to TOTP with an authenticator app.
The general process in five steps is described under Migrating to OPNsense.
FAQ
Questions about migrating from Fortinet FortiGate
Can we import the FortiGate configuration?
No. We translate in a structured way and remove legacy clutter along the way.
Is the throughput of OPNsense sufficient?
With appropriately sized hardware, yes. What matters is throughput with IPS enabled, and we plan for that realistically.
What happens to FortiToken?
We switch to TOTP. This works with common authenticator apps.
Contact
Send us your configuration export
We will tell you what can be transferred directly, what cannot and what the migration will cost.