Check Point to FortiGate Migration — Complete Technical Guide for Indian Enterprises

Check Point has been a trusted name in enterprise firewalls for decades. But as Indian enterprises face growing throughput demands, tighter budgets, and the need for converged security (SD-WAN, ZTNA, SASE), many are evaluating a migration to Fortinet FortiGate. This guide covers the complete migration path — from architecture mapping and hardware sizing to FortiConverter tool usage, policy conversion, VPN migration, and the manual work that no tool can automate. Every technical claim is sourced from official Fortinet and Check Point documentation.

Why Enterprises Migrate from Check Point to FortiGate

The decision to migrate is rarely about one factor. Based on our experience across Indian enterprises, the most common drivers are:

Architecture Mapping: Check Point to Fortinet

Before diving into migration mechanics, understand how the two platforms map at an architectural level:

Hardware Model Equivalents

Sizing should be based on Threat Prevention throughput (all security features enabled), not raw firewall throughput. All numbers from official vendor datasheets:

Sources: Check Point 6200 DS, 6600 DS, FortiGate 200G DS, 900G DS

FortiConverter: The Migration Tool

Fortinet's FortiConverter automates the conversion of Check Point configurations to FortiOS format. It comes in two forms:

What FortiConverter Converts

• Firewall policies (from CSV export or rulebases files)
• NAT rules — Hide NAT, Static NAT, Manual NAT (converted to IP pools, VIPs, central NAT policies)
• Network/host/group/service objects
• RADIUS, TACACS+, LDAP server definitions
• IPsec VPN — Traditional Mode (pre-R80.10) and Simplified Mode (meshed and star topologies)
• Schedules (day-in-week becomes recurring; day-in-month becomes one-time)
• VSX virtual systems (converts multiple VSYS at a time)
• Static routes

What FortiConverter Does NOT Convert (Manual Work Required)

Source: FortiConverter 7.4.0 — Check Point Conversions, Fortinet Community

Threat Prevention Blade Mapping

Every Check Point security blade has a FortiGuard equivalent. None of these are auto-converted by FortiConverter — all must be manually configured on FortiGate:

The 5 Biggest Migration Challenges

1. Policy Layers to Flat Rules

Check Point R80+ uses policy layers — Access Control layer, Threat Prevention layer, HTTPS Inspection layer. Layers can be shared across policy packages and have ordered/inline sub-layers. FortiGate uses a flat policy table with security profiles attached to each rule. FortiConverter flattens Check Point's layered structure into FortiGate's single-table format. This typically results in rule bloat — organisations commonly find they can remove 100+ unused or duplicate rules during cleanup.

2. NAT Translation

Check Point NAT is object-based (Hide NAT and Static NAT defined on the object itself) plus Manual NAT rules. FortiGate uses IP Pools (for SNAT), VIP objects (for DNAT), and Central NAT policies. FortiConverter handles the conversion but NAT global properties are excluded, and object-NAT is the area requiring the most manual attention post-conversion.

3. VPN Community Migration

Check Point VPN Communities (mesh/star) operate differently from FortiGate IPsec tunnels. The #1 interoperability issue is encryption domain / proxy-ID mismatch: Check Point allows subnet-based proposals, while FortiGate requires exact match on both sides. Check Point's domain-based VPN will not accept 0.0.0.0/0 as an encryption domain from FortiGate. During migration, use specific selectors or switch to route-based VPN (VTI) on both sides.

4. VSX to VDOM

Both platforms use Linux namespace technology for virtual firewall instances. Key difference: Check Point VSX instances share the same OS, patch level, and hardware view. FortiGate VDOMs are technically separate routers/firewalls with no inter-VDOM communication until you explicitly create vdom-links. FortiConverter supports converting multiple VSYS configurations.

5. Historical Log Continuity

Check Point logs (proprietary .log / .adtlog format) cannot be imported into FortiAnalyzer. Before decommissioning, use Check Point Log Exporter to send historical logs to a SIEM (Splunk, FortiSIEM) in syslog/CEF/JSON format. Maintain read-only access to the Check Point SMS during the transition period for compliance queries.

Step-by-Step Migration Methodology

Licensing: Check Point Blades vs Fortinet Bundles

India Market Context

Fortinet has 1,117 enterprise customers in India (12.10% of their global customer base), making India the 3rd largest market after the US and Brazil. Check Point has approximately 150 enterprise customers in India (9.03% of their global base). The most common Check Point models in Indian enterprises are Quantum 5200, 5600, 6200, and 6600 — all of which map to FortiGate G-series models that typically deliver 3–5x higher throughput at comparable or lower cost.

For Indian enterprises, the pricing dynamic is significant: Check Point's per-blade licensing compounds across multiple gateways. An organisation running 10 gateways with 5 blades each pays for 50 blade licenses. Fortinet's bundled model means you pay one subscription per appliance regardless of how many features you enable.

Sources: Enlyft — Fortinet Market Data, 6Sense — Check Point Market Share

How Ogma Handles Check Point to FortiGate Migration

Ogma is an authorised Fortinet partner with hands-on experience migrating enterprises from Check Point, Palo Alto, Cisco ASA, and SonicWall to FortiGate. Our migration service includes:

• Pre-migration audit — full configuration review of your Check Point environment including policies, NAT, VPN, routing, HA, and identity awareness
• Hardware sizing — model recommendation based on actual traffic analysis, not just peak throughput specs
• Best pricing on FortiGate hardware — competitive pricing with INR billing and GST invoice
• FortiConverter + manual rebuild — automated policy conversion plus manual configuration of routing, VPN, threat prevention, FSSO, HTTPS inspection, and HA
• Lab validation — full traffic testing in a parallel environment before cutover
• Zero-downtime cutover — scheduled maintenance window with rollback plan
• Post-migration support — 30-day observation period with 24/7 monitoring

Email us at [email protected] or contact Ogma for a migration assessment and FortiGate replacement quote.