Free Cisco ASA to FortiGate Cutover Checklist Template (Printable + CSV)

A free, printable cutover checklist for moving from Cisco ASA to Fortinet FortiGate. It covers 10 phases and 72 tasks, from config export to decommission, with owner, date, and status columns. Print it, fill it in on screen, or download the CSV for Excel or Google Sheets.

⬇️ Download the CSV

How to use it: tick the box when a task is done, and type an owner, date, and status (Not started, In progress, Done, or N/A) into each row. Edits stay in your browser tab only and aren't saved, so print or save as PDF when you're finished. On paper, the boxes and columns print blank for handwriting.

Cisco ASA to FortiGate cutover checklist

Site / firewall

Change ticket #

Maintenance window

Go/no-go owner

Rollback deadline

ASA model and version

FortiGate model and FortiOS version

1. Pre-migration discovery and config export

Know everything the ASA does before you change anything.

Done✓	Task	Owner	Date	Status
	1.1 Inventory every ASA: model, software version, failover pair, security contexts, interfaces, and VLANs.
	1.2 Check each model's end-of-support date on Cisco's support pages and note it in the change record.
	1.3 List everything that terminates on or depends on the ASA: site-to-site tunnels, remote-access VPN profiles, DHCP server or relay, syslog, SNMP, NTP, and RADIUS/TACACS+/LDAP servers.
	1.4 Export the configuration: run `terminal length 0`, then `show running-config`, and save the output as plain text (one file per security context). Keep a dated copy as the rollback reference.
	1.5 Capture current state for later comparison: `show route`, `show nat`, `show access-list` (hit counts), and `show crypto ipsec sa`.
	1.6 Document the implicit permits: for each interface without an inbound ACL, record what it passes to lower-security interfaces.
	1.7 Clean up before converting: remove unused objects, disabled and shadowed rules, and ACL entries with zero hits over a meaningful period.
	1.8 Confirm the target FortiGate model(s) and FortiOS version, and register them in FortiCare (HA members must be on the same FortiCare account).

2. FortiConverter or manual conversion review

Treat converter output as a first draft, not a finished config.

Done✓	Task	Owner	Date	Status
	2.1 Choose the conversion path: FortiConverter tool, the FortiConverter Service (a paid add-on for third-party firewalls), or a manual build.
	2.2 Decide NAT mode on purpose: FortiConverter's Cisco output uses central NAT. Switch to policy NAT before conversion if that's your standard.
	2.3 Map ASA interfaces to FortiGate ports, VLANs, and zones, and record the mapping.
	2.4 Rebuild what FortiConverter doesn't convert: identity NAT, NAT exemption, and wildcard netmasks in access lists and object groups.
	2.5 Check static NAT rules where source and mapped IPs are the same (not converted by design) and recreate any you still need.
	2.6 Rename objects that came through with the `_conflict` suffix.
	2.7 Lock down `allowaccess` on every interface: FortiConverter enables all management services on converted interfaces.
	2.8 Assign IPsec Phase 1 authentication per VPN (FortiGate supports pre-shared key and RSA signature).
	2.9 If the source is Cisco FTD: only the LINA (layer 4) policy converts. Plan IPS and other layer 7 controls separately.

3. Object, policy, and NAT validation

Prove the new rulebase does what the old one did, and nothing more.

Done✓	Task	Owner	Date	Status
	3.1 Spot-check converted address and service objects and groups against the ASA config.
	3.2 Create explicit firewall policies for every implicit permit you documented in phase 1.
	3.3 Review policy order: FortiGate evaluates policies top-down and uses the first match.
	3.4 Enable logging on the implicit deny policy so dropped traffic is visible after cutover.
	3.5 Validate VIPs and their matching policies for every published server.
	3.6 Validate outbound source NAT and IP pools for each internal segment.
	3.7 Harden administrative access: admin accounts, trusted hosts, and management interfaces only where needed.
	3.8 Get a peer review of the final rulebase and NAT before staging.

4. VPN migration (site-to-site and remote access)

VPNs are their own workstream; give them their own owner.

Done✓	Task	Owner	Date	Status
	4.1 Site-to-site: list every peer with peer IP, IKE version, Phase 1/Phase 2 proposals, DH groups, lifetimes, and protected subnets.
	4.2 Site-to-site: confirm settings and the cutover window with each peer's owner (partners, branches, and cloud tunnels).
	4.3 Site-to-site: make sure VPN traffic isn't source-NATed (NAT exemption rules don't convert).
	4.4 Site-to-site: add routes for remote subnets through each tunnel interface and the firewall policies the tunnel needs.
	4.5 Remote access: design an IPsec dial-up VPN with FortiClient. SSL VPN tunnel mode was removed in FortiOS 7.6.3.
	4.6 Remote access: use IKEv2 (it can run over TCP port 443). FortiClient dropped IKEv1 support starting with version 7.4.4.
	4.7 Remote access: configure the address pool, DNS, split-tunnel settings, and MFA/identity integration.
	4.8 Remote access: package and deploy FortiClient, pilot with real users, and send user communications before cutover.

5. Routing

Make sure traffic arrives at, and returns through, the new firewall.

Done✓	Task	Owner	Date	Status
	5.1 Recreate static routes, including the default route, and verify distances and priorities.
	5.2 Rebuild any dynamic routing (OSPF or BGP) the ASA participated in and verify neighbors in staging.
	5.3 Update routes on neighboring routers and core switches that point at ASA addresses if any next-hop IPs change.
	5.4 Check for asymmetric paths: a stateful firewall drops return traffic for sessions it didn't see start.
	5.5 Record expected routing tables to compare against the phase 1 `show route` output after cutover.

6. High availability

Build and test the cluster before it carries production traffic.

Done✓	Task	Owner	Date	Status
	6.1 Confirm both FortiGates are the same model with the same firmware and hardware configuration (an FGCP requirement).
	6.2 Cable heartbeat links; Fortinet recommends two back-to-back heartbeat connections.
	6.3 Use a unique HA group ID for each cluster in the same broadcast domain to avoid virtual MAC conflicts.
	6.4 Cable both members identically to the internal and external switches.
	6.5 Verify cluster status and config sync with `get system ha status`.
	6.6 Test failover in both directions in staging and confirm switches learn the virtual MACs (gratuitous ARP is enabled by default).

7. Cutover window

Run the window from a written, timed runbook.

Done✓	Task	Owner	Date	Status
	7.1 Change approved; maintenance window, go/no-go owner, and rollback deadline set and communicated.
	7.2 Final ASA config export and a FortiGate configuration backup taken just before the change.
	7.3 Console or out-of-band access confirmed for both firewalls; ISP and VPN peer contacts on standby.
	7.4 Move cabling and IP addresses per the runbook.
	7.5 Clear ARP caches on upstream routers and switches (or have the ISP do it) if the new firewall's MAC addresses differ.
	7.6 Bring up and verify each site-to-site tunnel.
	7.7 Run the post-cutover test list (phase 9) and record results.
	7.8 Make the go/no-go call at the scheduled time.

8. Rollback plan

Decide how you'll back out before you need to.

Done✓	Task	Owner	Date	Status
	8.1 Write down the conditions that trigger a rollback and who makes the call.
	8.2 Set a rollback deadline that leaves enough of the window to put the ASA back in path.
	8.3 Keep the ASA racked, powered, configured, and cabled (or with labeled cables ready to swap).
	8.4 Document rollback steps: re-cable, restore IPs, clear ARP caches, and revert any peer-side VPN changes.
	8.5 Name who notifies users, peers, and the help desk if you roll back.
	8.6 Keep the ASA ready to swap back until the FortiGate has run cleanly through normal business traffic.

9. Post-cutover validation

Test the flows users and partners depend on, then watch the logs.

Done✓	Task	Owner	Date	Status
	9.1 User internet access, DNS, and DHCP from each internal segment.
	9.2 Published servers (VIPs) reachable from outside.
	9.3 Each site-to-site tunnel passes traffic in both directions.
	9.4 Remote-access VPN: sign-in with MFA and access to internal resources.
	9.5 Authentication servers, SNMP monitoring, syslog to your SIEM, and NTP.
	9.6 Review traffic dropped by the implicit deny and add policies for legitimate flows the ASA allowed.
	9.7 Trace problem flows with `diagnose debug flow` (traffic offloaded to NP6/NP7 processors won't appear; test with ICMP or disable offload for that policy).
	9.8 Run an HA failover test if it wasn't done in the window, and monitor through the first full business day.

10. Decommission and close-out

Finish the job so the ASA doesn't linger.

Done✓	Task	Owner	Date	Status
	10.1 Update network diagrams, runbooks, CMDB, and monitoring for the FortiGate.
	10.2 Schedule regular FortiGate configuration backups.
	10.3 Remove the ASA from monitoring, DNS, and IPAM.
	10.4 Wipe the ASA configuration (`write erase`) and dispose of or return the hardware per policy.
	10.5 Retire the ASA support contract and licenses.
	10.6 Close the change record and capture lessons learned.

Sources

Fortinet-specific items were checked against Fortinet's documentation on October 26, 2026:

FortiConverter supported versions and conversions and Cisco conversion notes
FortiConverter Service FAQ
SSL VPN tunnel mode no longer supported in FortiOS 7.6.3 and Fortinet's SSL VPN to IPsec VPN migration guide
FortiOS 7.6 Administration Guide: FGCP, cluster virtual MAC addresses, and debugging the packet flow

Check the docs for your exact FortiOS and FortiConverter versions before cutover; behavior can change between releases.

Free template from RackGuide · rackguide.net/guides/asa-to-fortigate-cutover-checklist-template.html · Last reviewed October 26, 2026

FAQ

Is this checklist free?

Yes. You can print the page, fill it in on screen, or download the CSV version for Excel or Google Sheets. No sign-up is required.

Does FortiConverter replace this checklist?

No. FortiConverter translates ASA objects, ACLs, NAT, routes, VPN, and more into FortiOS, but Fortinet's notes say identity NAT, NAT exemption, and wildcard netmasks aren't supported, and converted interfaces have all management services enabled. Review and testing are still on you.

What changes for remote-access VPN users?

Plan an IPsec dial-up VPN with FortiClient. Starting in FortiOS 7.6.3, SSL VPN tunnel mode was removed from all FortiGate models, and Fortinet generally recommends IKEv2, which can run over TCP port 443.

What columns are in the CSV?

Phase, Step, Task, Done, Owner, Target date, Status, and Notes, with one row per task in the same order as the printable page.

More RackGuide guides

Guide

Free Cisco ASA to FortiGate Cutover Checklist Template (Printable + CSV)

Cisco ASA to FortiGate cutover checklist

1. Pre-migration discovery and config export

2. FortiConverter or manual conversion review

3. Object, policy, and NAT validation

4. VPN migration (site-to-site and remote access)

5. Routing

6. High availability

7. Cutover window

8. Rollback plan

9. Post-cutover validation

10. Decommission and close-out

Sources

FAQ

Is this checklist free?

Does FortiConverter replace this checklist?

What changes for remote-access VPN users?

What columns are in the CSV?

More RackGuide guides

VMware vs. Nutanix

VMware alternatives after Broadcom

Fortinet Secure SD-WAN vs. HPE EdgeConnect

Cisco ASA to FortiGate migration checklist

LogicMonitor vs. Grafana for IT infrastructure monitoring

Free Cisco ASA to FortiGate Cutover Checklist Template (Printable + CSV)

Cisco ASA to FortiGate cutover checklist

1. Pre-migration discovery and config export

2. FortiConverter or manual conversion review

3. Object, policy, and NAT validation

4. VPN migration (site-to-site and remote access)

5. Routing

6. High availability

7. Cutover window

8. Rollback plan

9. Post-cutover validation

10. Decommission and close-out

Sources

FAQ

Is this checklist free?

Does FortiConverter replace this checklist?

What changes for remote-access VPN users?

What columns are in the CSV?

Get the weekly RackGuide brief

Related RackGuide listings

Fortinet FortiGate

Cisco Secure Firewall

More RackGuide guides

VMware vs. Nutanix

VMware alternatives after Broadcom

Fortinet Secure SD-WAN vs. HPE EdgeConnect

Cisco ASA to FortiGate migration checklist

LogicMonitor vs. Grafana for IT infrastructure monitoring

📬 The RackGuide newsletter