Network migration

From

Cisco ASA

→

Fortinet FortiGate

Cisco ASA to FortiGate migration — UK enterprise programme

Cisco ASA reaches end-of-sale and most UK enterprises now treat the refresh as a forcing function to evaluate alternatives. FortiGate is the most-shortlisted destination — best throughput per pound, native SD-WAN + ZTNA + SASE included, single-pane management via FortiManager. Servnet runs end-to-end ASA → FortiGate migrations including rule conversion, parallel running and per-site cutover.

Scope your migration →📞 0800 987 4111

Vendor migration programme — Cisco ASA source on the left, Fortinet FortiGate target on the right, with parallel-running data streams converging through a central Servnet cutover hub.

From → To: Cisco ASA vs Fortinet FortiGate

Typical outcomes

What good looks like after a Cisco ASA → Fortinet FortiGate migration

Throughput uplift

×3-5

Typical FortiGate replacing an ASA at similar £-band — sized for current + future load.

Per-site cutover

30-60 min

Single firewall site cutover with rule conversion + validation.

5-yr TCO vs Firepower

−35%

Typical TCO advantage for FortiGate vs equivalent Cisco Firepower throughput class.

Migration window

8-14 wk

End-to-end for a 10-30 site estate.

The why

Why UK organisations migrate from Cisco ASA to Fortinet FortiGate

✓ASA reached EoS — Firepower or alternative refresh required
✓FortiGate ships SD-WAN + ZTNA + SSL inspection native — no add-on licences
✓Best throughput per £ in UK NGFW market (typically 30-40% lower TCO vs Firepower at equivalent throughput)
✓Single-pane FortiManager across firewalls + switches + Wi-Fi + SD-WAN
✓Modern OS (FortiOS) with regular feature releases — vs ASA's feature-frozen final code
✓UK engineer pool is the largest of any vendor — easier to hire + contract

How we run it

Migration phasing — typical Cisco ASA → Fortinet FortiGate programme

Cisco ASA → Fortinet FortiGate — programme timeline

1
Discovery + rule extraction
Weeks 1-3
ASA config extraction; FortiConverter or manual rule analysis; FortiGate sizing per site; FortiManager + FortiAnalyzer architecture; SD-WAN overlay design (if applicable).
2
FortiGate platform build
Weeks 4-6
Hardware delivery; FortiManager + FortiAnalyzer deployment; central policy templates; SD-WAN overlay; certificate + identity integration.
3
Pilot site cutover (1-3 sites)
Weeks 7-8
Non-critical sites cutover first with on-site engineer; rollback rehearsal; performance + functional validation; user acceptance.
4
Phased site cutover
Weeks 9-13
Remaining sites cutover in waves (typical 3-5 sites per weekend); rollback option preserved for 24h post-cutover; ITSM tracked.
5
ASA decommission
Week 14
Final sites cutover; ASA hardware decommissioned via WEEE-compliant routes; FortiManager + FortiAnalyzer operational handover.

Included in scope

What Servnet delivers in a Cisco ASA → Fortinet FortiGate migration

FortiConverter rule conversion

Free Fortinet tooling — we run + validate + remediate the converted ruleset before any cutover.

Hardware procurement

<a href="/fortinet/products">FortiGate models</a> sized per site — quoted at vendor-direct pricing.

Central FortiManager + FortiAnalyzer

Single-pane management + logging + reporting across the entire fleet.

SD-WAN overlay (optional)

Native FortiGate SD-WAN at no licence uplift — included if you're consolidating MPLS + broadband + LTE at branch.

Per-site cutover runbook

Each site gets a runbook with cutover steps, rollback triggers, validation tests, comms script.

Post-migration support

90-day hypercare; optional ongoing managed FortiGate service.

De-risking the cutover

Top risks + how we mitigate them

⚠️ ASA rules accumulated complexity over 10+ years

Rule analysis phase catalogues every rule + hit-count; unused / redundant / shadowed rules removed before conversion. Typical result: 30-50% rule-set reduction with no functional impact.

⚠️ Tooling integrations to ASA syslog / SNMP

FortiAnalyzer covers most SIEM use cases natively; for specific integrations (e.g. legacy SIEM that only knows ASA syslog format), we maintain a syslog forwarder during transition + replace the integration on the new platform.

⚠️ Internal team trained only on ASA / IOS CLI

FortiGate training included; FortiOS GUI + CLI are well-documented; 90-day hypercare. Most ASA admins are productive on FortiGate within 2-3 weeks.

⚠️ Cutover impacts production during weekday hours

Cutovers scheduled for change windows (weekend / overnight); pre-cutover dry-runs in staging; rollback option preserved for 24h post-cutover.

Pricing guide rail

Indicative: ASA → FortiGate migrations for a 10-30 site estate typically run £25k-£65k professional services (excluding FortiGate hardware + licences). Total programme cost (hardware + licences + services) typically 30-45% below equivalent Firepower refresh at year-3 break-even — and capability is meaningfully wider (SD-WAN, ZTNA, SASE native). Talk to us for a sized commercial proposal.

Frequently asked

FAQs — Cisco ASA → Fortinet FortiGate

Should we go to FortiGate or Cisco Firepower?

Honest answer: it depends on your existing stack. If the rest of your network + management estate is Cisco-led, Firepower keeps the single-pane discipline. If you're cost-sensitive or want the SD-WAN + ZTNA bundling, FortiGate is the typical winner. Our full migration playbook covers the decision framework.

What about our existing AnyConnect / VPN clients?

FortiGate ships FortiClient for SSL VPN + ZTNA. Most enterprises take the ASA migration as the opportunity to also migrate from flat VPN to ZTNA.

Can we do this without weekend outages?

Single-firewall sites need a brief change window (30-60 min typical). For HA pairs with seamless failover, we cutover one chassis at a time with no production impact. Multi-site estates run cutover waves over consecutive weekends.

How does this compare to Palo Alto?

Palo Alto is a premium tier — best for security-first, regulated environments where price is secondary to security depth. FortiGate is the cost-effective default for UK mid-market. Our 2026 firewall buyer's guide covers the full compare.

Go deeper

📖 ASA-to-Firepower-or-FortiGate playbook →FortiGate firewalls →FortiGate hardware →FortiGate SD-WAN →

Ready to scope your Cisco ASA → Fortinet FortiGate migration?

30-minute discovery call with an engineer who's run this migration before. Honest scoping, no sales script.

Book a scoping call →

💷 Spread the cost · IT finance

Finance the hardware behind your Cisco ASA → Fortinet FortiGate migration

Spread the cost of the target Fortinet FortiGate platform, servers and storage across a lease or hire-purchase term instead of a single capital outlay — keep the migration moving without a big up-front bill. Indicative terms; subject to status.

See IT finance options →

Indicative estimate · subject to change · no credit check at this stage · hire purchase, lease & subscription for UK businesses

Indicative illustration only. Servnet Limited is not authorised or regulated by the FCA and does not provide financial advice or arrange finance. All finance opportunities are referred to Number Eight Business Finance. Finance policy