After migration from FortiSRA to FortiPAM, the original FortiSRA administrator becomes a regular administrator on FortiPAM with the ability to create/edit/launch secrets.

This is a free administrator account.

After migration from FortiSRA to FortiPAM, native launchers are automatically created and added to the default templates.

If you do not want to display the native launchers, remove them from the following default templates:

• Unix Account (SSH Password), VNC Server, FortiGate/FortiOS (SSH Key),FortiGate/FortiOS (Web), Machine, Windows Domain Account, etc.

After migration from FortiSRA to FortiPAM, the GUI can report the Configuration can contain errors warning.

Run:

 diag debug config-error-log read

Output:

"end" @ global.system.replacemsg.auth.auth-sra-login-page:failed command (error -56)
 "end" @ global.system.replacemsg.auth.auth-sra-token-page:failed command (error -56)
 "end" @ global.system.replacemsg.auth.auth-sra-passchg-page:failed command (error -56)

The above output is harmless to your system.

Run the following command to clear the output:

diag debug config-error-log clear

After you migrate from FortiSRA to FortiPAM, you can no longer downgrade back to FortiSRA.

Ensure that you create a snapshot of your FortiSRA before the migration to FortiPAM.

If the FortiSRA license is expired, FortiSRA license may not be available.

If using a new FortiPAM license to replace an expired FortiSRA license, the following must be performed: