FORTINET FC-10-0401E-289-02-DD Firewalls

FC-10-0401E-289-02-DD Procurement Check

FC-10-0401E-289-02-DD is the historical SD-WAN Overlay Controller VPN subscription for one existing FortiGate 401E. It supplied cloud-assisted overlay and portal orchestration; it did not include the FortiGate appliance, WAN circuits, managed operations, threat-protection subscriptions or automatic application acceptance.

Platform Transition

For the 401E, model multiple business segments instead of migrating one undifferentiated subnet list. Assign each advertised prefix to an owner, required hub, permitted spoke paths and security policy. Build OaaS with those boundaries, validate BGP learning and SD-WAN rules, and test that an unauthorized segment cannot traverse the overlay. Record route withdrawal and application recovery during underlay failover.

The 401E review is about limiting blast radius. Acceptance requires proof that orchestration does not create unexpected east-west access and that removing one prefix withdraws it cleanly without disturbing unrelated segments or shared services.

Compatibility Decision

Fortinet documents OCVPN as the cloud-based IPsec overlay mechanism used by FortiOS 7.2.4 and earlier, while Overlay-as-a-Service supports later FortiOS releases and a different orchestration workflow. Treat code 289 as a legacy identity: confirm platform support, current successor entitlement and migration design rather than assuming a like-for-like license renewal.

• Inventory OCVPN community, hub or spoke role, interfaces, subnets, routes, policies and recovery access.
• Confirm FortiOS eligibility, OaaS entitlement, account, region, hub design and every participating spoke.
• Test IPsec, BGP, SD-WAN rules, authorized and denied paths, underlay failure, route withdrawal and rollback.
• Retain topology, cloud tasks, device state, application acceptance, exceptions and migration owner.

Official sources: Fortinet OCVPN to OaaS Migration Guide; FortiOS OCVPN CLI reference; FortiGate 401E data sheet.