Firewall Migration Services
SonicWall to Fortinet. Meraki MX to Fortinet. WatchGuard to Fortinet. Cisco ASA to Fortinet. Firewall migration from $6,500 for a single FortiGate up to the 90-series class, from $8,900 for a 100F–200F unit or an HA pair (two firewalls so one can fail). We translate the old firewall’s rules by hand, run the new box alongside the old one where the network allows, switch over in a scheduled window with a written rollback plan, and check everything afterwards. Multi-site capable. We agree the cutover window and rollback plan with you before work starts.
Track Record
We only do networks. That is not a limitation — it is why the outcomes are different.
Years of network-only practice. Architecture, security, and operations — not IT generalism.
Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.
Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.
The same senior engineer, start to finish. No junior handoffs. No ticket queue. No escalation chain.
Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.
Why Firewall Migrations Get Messy
Vendor migration tools (Fortinet’s, Cisco’s, Palo Alto’s) all promise to translate your existing config. They all do, partially. What they don’t do: catch the rules that only worked because of how the old vendor rewrote addresses (NAT), rebuild the attack-inspection rules (IPS) that don’t map one-to-one, or test the migrated config under real traffic. That last 20% — the part the tools miss — is where migrations break. We do that part by hand.
Auto-conversion tools handle 80% of the rules. The remaining 20% — vendor-specific logic, NAT quirks, IPS rule semantics, VPN settings — gets translated by an engineer who understands both vendors. Without that, you ship a migration that works in lab and breaks under production load.
Where the network topology allows, we deploy new firewalls in parallel with the old ones, validate the new config under real traffic, then cutover with one well-tested change. Parallel deployment lets us validate before the scheduled cutover, not during it.
Every cutover has a documented rollback. If something goes wrong post-cutover that we cannot fix in the maintenance window, we revert to the old firewall and analyze the issue without business impact. Migration projects with no rollback path are gambles, not engineering.
We migrate from SonicWall, Meraki, WatchGuard, Cisco ASA, Palo Alto, and others to FortiGate. Cisco or Meraki targets are quoted separately after scoping. The engineer leading your migration knows both vendors well, not just the destination.
Migration Project Phases
Every firewall migration is the same five phases. Each is documented, each has explicit deliverables.
Full inventory of the existing firewall: rule base, NAT policies, IPS/IDS posture, SSL inspection, VPN tunnels, identity-provider integration, custom scripts. Output: documented current state and risk register.
Translation of source config to target vendor. Auto-conversion tools handle 80%; the remaining 20% (vendor-specific NAT logic, IPS rule semantics, VPN settings, custom scripts) gets translated by hand. Output: target firewall config, ready for lab validation.
Target config deployed in lab or in parallel position with old firewall. Traffic patterns tested, IPS rule behavior validated, VPN tunnels established. We don’t cutover a config that hasn’t been tested under real traffic patterns first.
Scheduled maintenance window. Cutover steps documented and rehearsed. Post-cutover validation steps run live. If post-cutover validation fails, rollback path executes — no business impact beyond the maintenance window. At remote sites, an out-of-band console connection keeps a path to the new FortiGate if the cutover cuts off normal remote access.
Five business days of hypercare after cutover: we watch the new firewall and fix what the first week of real traffic turns up. Tuning IPS rules, fine-grained policy adjustments based on actual traffic, decommission of old firewall once new one is stable. Documentation handed off to your team or transitioned to ongoing managed operations.
Multi-site migrations: each site is its own contained Phase 4–5 cycle. Sites cutover in waves of 3–5, with 1–2 week stabilization between waves. A problem at site 5 does not block sites 1–4 from being live on the new architecture.
Migration Patterns We Run
Different starting vendors, same engineering discipline. Already on FortiGate and losing SSL VPN in FortiOS 7.6.3? See FortiGate SSL VPN migration. Running a 60E or another end-of-life model? See FortiGate end-of-life replacement. Two or more sites? See Fortinet MSP for multi-site networks.
National scope. Migration project work is primarily remote engineering. Cutovers are remote-guided by default; on-site cutover is available in Sacramento, the Bay Area and San Jose and quoted with the migration. On site in Sacramento (Sacramento Fortinet MSP) and the Bay Area (Fortinet MSP in San Francisco); remote for multi-site clients nationally. For hourly engineering or temporary project support, see Fortinet professional services.
Our Approach
No mystery. No black box. Every step is documented, explained, and approved before execution.
A Network Risk Assessment of your current network, at a fixed price. Configurations reviewed, segmentation (separate lanes so a problem in one can’t reach the others) checked and gaps documented, in writing.
Address critical risks first, then build toward a standardized architecture. Every change documented, tested, and scheduled with a rollback plan.
Ongoing monitoring, documented changes and, from Edge Secure up, scheduled reviews. The network does not just work today — it evolves with your operations.
Your Engineer
Every migration has one senior network engineer as your point of contact, from the assessment and rule review through cutover and ongoing operations. That engineer knows your policies, your compliance requirements and your maintenance windows, so the context from the old firewall carries into the new one.
Background: Founder, ex-Meta. Past engagements include Cisco, Wells Fargo, Fannie Mae, and other Fortune 500 networks — the same caliber of engineering, now applied to mid-market organizations.
We are a Fortinet Engage Advocate partner and supply FortiGate, FortiSwitch and FortiAP. We also monitor and manage the Cisco, Aruba, Arista and other enterprise gear you already run. You don’t have to rip anything out to work with us.
When Migrations Make Sense
Migrations are driven by specific business events. If one of these is on your desk, the project is already due.
The clearest trigger. Vendor announces EOS for the platform you’re running, support contracts get expensive, security updates stop. Migrating to a current platform is no longer optional — it’s a deadline-driven project.
Existing vendor licensing has gotten expensive (per-user, per-feature creep), or the FortiGate equivalent costs significantly less for similar capability. If the license gap is large enough, the migration fee can pay for itself on license savings alone; we show you the arithmetic before you sign.
Existing firewall doesn’t do something the business now needs: SD-WAN, ZTNA, modern IPS, compliance-grade logging. Rather than bolt on multiple new tools, migrate to a platform that includes the capability natively.
Post-acquisition cleanup: two organizations with different firewall vendors. Migrating to a single standard reduces operational overhead and security tooling fragmentation. It can run alongside the broader IT integration.
SOC 2 audit findings, HIPAA risk-assessment outputs, or PCI-DSS scope reduction projects can surface that the existing firewall doesn’t produce the evidence auditors want. Migration to a platform that does (with proper change-management processes wrapped around it) becomes the path forward.
Switching from one managed service provider to another. The outgoing MSP’s preferred vendor may differ from the incoming one. Migration project bundled with the MSP transition simplifies the operational handoff.
FAQ
We standardize on Fortinet for three reasons: capability consolidation (SD-WAN + ZTNA + IPS + Wi-Fi + secure remote access in one platform vs. 3–5 separate tools), per-site economics (FortiGate gives mid-market organizations enterprise-grade security without enterprise per-user pricing), and operational depth (we run Fortinet practice deeply, which compounds across clients). For Cisco or Meraki shops we can implement on Cisco instead, quoted after scoping — we just won’t recommend it as a new-build standard for mid-market.
Partially. Fortinet’s migration tools (and similar from other vendors) translate the easy 80% of rules cleanly. The hard 20% — vendor-specific NAT logic, custom IPS rules, VPN configurations with bespoke settings, integration scripts — needs hand translation. Migrations that rely solely on auto-conversion ship configs that work in lab and break in production. We do the hand-translation portion.
Rollback. Every cutover plan documents the exact steps to revert to the original firewall. If post-cutover validation fails in ways we can’t fix in the maintenance window, we revert — no business impact, no data loss. Then we analyze the failure mode and re-plan. We’ve never had a multi-site migration where every site cut over flawlessly the first time; what matters is the rollback path always works.
Single-site migrations typically run 4–8 weeks end-to-end (audit, design, lab, cutover, post-cutover). Multi-site migrations run 3–9 months in waves depending on site count and complexity. Hardware procurement and license processing are sometimes the longest single dependency — we start that in Phase 1 to keep the project on schedule.
A migration from another vendor, or a FortiGate replacement that changes the design, starts at $6,500 for a single FortiGate up to the 90-series class. A 100F to 200F unit or an HA pair starts at $8,900. The assessment sets the fixed fee. Both migrations include every firewall rule with no cap, every existing VPN tunnel, routing and SD-WAN (two or more internet lines, traffic steered to the best one automatically) carried over, the security-inspection profiles (UTM), a written test plan, an after-hours cutover window, five business days of hypercare, and an as-built: the map of what is actually installed. A like-for-like swap of an end-of-support FortiGate to the current model, same design, single unit up to the 90-series class, is $2,500 (see the FortiGate end of life page) and counts toward the migration fee if the job grows into a redesign within 90 days of the cutover. Moving remote users off SSL VPN to IPsec or ZTNA is included within the agreed migration scope limits; users, applications or identity work beyond those limits are quoted after scoping. Larger models, multiple sites, or a multi-vendor source are scoped after the Network Risk Assessment. Hardware and licenses are quoted separately by exact part number (see Fortinet reseller); budget roughly $2,000–$15,000 per site depending on FortiGate model and license tier. Shipping is billed at actual cost and sales tax follows the ship-to address.
Yes. After the migration, you can move the new firewall onto a managed plan from $695 per site per month: automated monitoring, config backups, a monthly summary (policy reviews on the Compliance plan), and a human response Mon–Fri, 8 AM–5 PM Pacific. 12-, 24- or 36-month initial term; give notice in the first 90 days and you can leave with no early-termination fee. A migration can be the start of that, not a one-shot project.
Related
Replacing a specific vendor? See Sophos UTM end of life: the FortiGate alternative, SonicWall Gen 6 end of support: the FortiGate alternative and Meraki MX end of life and license expiry: the FortiGate alternative. Still choosing? Compare Fortinet vs Meraki first.
Choosing the replacement model? See the FortiGate 30G vs 50G vs 70G vs 90G sizing guide. Budgeting what the new firewall costs to run afterwards? See managed firewall cost.
Start the Firewall Migration
Before we plan a target architecture or schedule a cutover window, we audit what you have today. Output: a documented current-state inventory, gap analysis against your migration goals, and a recommended migration plan with phasing. Whether you proceed with us or take it to another partner, the audit is yours. The migration itself is quoted as a fixed fee once the audit or assessment sets the scope. Not sure the firewall is the real problem? Start with a Network Risk Assessment instead: $3,500 for a single small site; larger networks are priced on the assessment pricing page. See a sample report (PDF).
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.
