topic Re: Fortinet User configuration in SmartMove

Fortinet User configuration

Denis_Romanov — Fri, 22 Apr 2022 06:57:45 GMT

Hi! I have a Fortigate configuration (v.6.09) and trying to convert AD groups however it seems those are just ignored in the conversion process for some reason. I've specified an LDAP Account Unit (which is needed to generate a valid mgmt_cli commands) but Access Roles are not created during the conversion.

Here is how it looks in Fortigate config:

edit "AD_group_test" set member "AD_LDAP_AU" config match edit 1 set server-name "AD_LDAP_AU" set group-name "CN=AD_group_test,OU=InfoSec,OU=Test,OU=Groups,OU=DC01,DC=test,DC=local" next end

And this group is used in the Firewall policy:

edit 20911 set uuid 0e48bc7a-bf0b-51ec-d77a-8de1cc2533c7 set srcintf "any" set dstintf "any" set srcaddr "Private_nets" set dstaddr "10.0.0.1" "10.0.0.2" "10.0.0.3" "Net_10.0.1.0/24" set action accept set schedule "always" set service "ALL" set logtraffic all set groups "AD_group_test" set global-label "General rules" next

But SmartMove doesn't generate any Access Role objects (x0)..

Any input on what may be wrong here? From Release Notes it seems that it should be supported..
I'm using the latest SmartMove version 6.0.8068.6581.

Re: Fortinet User configuration

Ofir_Shikolski — Sun, 24 Apr 2022 07:03:14 GMT

Hi,

SmatMove does not generate AD groups, you will need manually to generate it.

Re: Fortinet User configuration

Denis_Romanov — Sun, 24 Apr 2022 07:28:40 GMT

Hi Ofir!

Then could you please clarify what is meant by this statement in the SK?

Users

SmartMove cannot create LDAP account unit objects that are needed for the user configuration process. You will need to create this object manually and provide the name of this object to SmartMove for conversion.

Also this is confusing:

Only Firewall, NAT and Users/Groups configuration (AD) will be converted (including network objects, services, and schedules).

What users are converted?

Re: Fortinet User configuration

Ofir_Shikolski — Sun, 24 Apr 2022 10:57:55 GMT

Hi @Denis_Romanov ,

Can you please send me the config file? ofirs@checkpoint.com

it is working for me 🙂

Re: Fortinet User configuration

the_rock — Sun, 24 Apr 2022 21:59:03 GMT

Not sure why it fails for you...I did this conversion before and it converted everything.

Re: Fortinet User configuration

Ofir_Shikolski — Tue, 14 Jun 2022 05:41:00 GMT

The issue was: not object were found in the config file.