FORTINET FC-10-F6H0E-289-02-DD Firewalls

FC-10-F6H0E-289-02-DD Legacy Overlay Identity

FC-10-F6H0E-289-02-DD is the historical SD-WAN Overlay Controller VPN subscription for one existing FortiGate 600E. It supplied cloud-assisted overlay and portal orchestration; it did not include the FortiGate appliance, WAN circuits, managed operations, threat-protection subscriptions or automatic application acceptance.

OCVPN and OaaS Boundary

Fortinet documents OCVPN as the cloud-based IPsec overlay mechanism used by FortiOS 7.2.4 and earlier, while Overlay-as-a-Service supports later FortiOS releases and a different orchestration workflow. Treat code 289 as a legacy identity: confirm platform support, current successor entitlement and migration design rather than assuming a like-for-like license renewal.

FortiGate 600E Migration Test

For a 600E hub or large spoke, capture HA roles, loopbacks, BGP neighbors, IPsec state, SD-WAN members and performance SLA before touching OCVPN. Design the OaaS region and dual-hub relationship explicitly, then migrate a controlled spoke. Exercise peer failover, carrier loss, route convergence and spoke-to-spoke shortcuts while monitoring both appliances. Roll back from a tested revision if identity or routing diverges.

The 600E evidence pack must prove HA symmetry. Compare tunnel and route state on both peers before, during and after failover, and have network operations approve convergence while application owners approve transaction recovery.

• Inventory OCVPN community, hub or spoke role, interfaces, subnets, routes, policies and recovery access.
• Confirm FortiOS eligibility, OaaS entitlement, account, region, hub design and every participating spoke.
• Test IPsec, BGP, SD-WAN rules, authorized and denied paths, underlay failure, route withdrawal and rollback.
• Retain topology, cloud tasks, device state, application acceptance, exceptions and migration owner.

Official sources: Fortinet OCVPN to OaaS Migration Guide; FortiOS OCVPN CLI reference; FortiGate 600E data sheet.