topic Re: Expedition SonicWall Support? in Expedition Discussions

Expedition SonicWall Support?

MichaelMelone — Wed, 03 Oct 2018 22:17:26 GMT

Hi,

It appears that SonicWall configs are not supported in the Expedition Migration Tool. Are there any plans to add support for this firewall vendor?

Thanks.

Re: Expedition SonicWall Support?

alestevez — Thu, 04 Oct 2018 07:40:30 GMT

Hi,

Its in our radar but we dont have any release date yet, I will post it here when we are close

Regards

Re: Expedition SonicWall Support?

KenLynch — Mon, 15 Oct 2018 18:40:43 GMT

My Palo Alto guy was super helpful in this reguard but I still need help.

"This is what I got back from the SE org. "We handle it [SonicWall Migration] through CSV import function:"

1) Retrieve exported config from sonicwall (it’s base64 encoded, so it needs to be parsed)

2) Download SonicReader (free), it spits out the config in an HTML file

3) Copy the HTML tables and paste into exel. Format the data appropriately. There are some nuances, for example Sonicwall service objects might be “TCP” but migration tool looks for “tcp” in lower case. This is just trial and error.

4) Save file as a CSV and change to a semi-colon delimited file

5) import CSV into MT.

- I recommend doing it in small stages. Eg. Import address objects first and actually push it to the candidate config of a firewall. If there are formatting issues, better to learn now than when pushing a full config consisting of address objects, groups, service objects, policies, etc and you get over 1000 errors. Once you complete the address objects, move to address groups, push to the candidate config of a firewall, etc."

I was able to get through most of those steps successfully and was able to upload them into the import section of the tool. Unfortunately there are 12 different sections in the HTML I generated and only 9 differently named sections to upload CSV files.

These are the sections from HTML These are the options in the MT

01PNT-Interfaces.csv “interfaces”

02PNT-AddressObjects.csv This likely correlates to the “Address” dropdown in Expedition import

03PNT-AddressGroups.csv “address groups” is an exact match

04PNT-ServiceObjects.csv “Services”

05PNT-ServiceGroups.csv “Service Groups”

06PNT-Zones.csv

07PNT-FirewallPolicies.csv

08PNT-NATPolicies.csv

09PNT-UserObjects.csv

10PNT-UserGroupObjects.csv

11PNT-IPSec-Tunnels.csv

12PNT-RoutingObjects.csv

…but the Regions, Security Rules, and Static Routes from the Expedition import window don’t seem to correlate to the HTML sections.

Everything was presented very nicely as a table in the HTML file but the Zones did not show up in a table so I'm not sure how to configure them.

Re: Expedition SonicWall Support?

bspilde — Tue, 13 Nov 2018 15:38:47 GMT

This process, mostly SonicReader, didn't seem to work correctly for me.

Something I am trying instead is this:

Download and Install FortiNet's FortiConverter (Original price at CDW was $3,068.99 for 1yr, on sale for $926.01)
Convert SonicWall config to FortiNet
Use Expedition to import and convert FortiNet config to Palo Alto Networks.

If this is successful I'll update with more notes.

Re: Expedition SonicWall Support?

DelvinC — Wed, 17 Apr 2019 23:51:32 GMT

@bspilde Did the FortiConverter route work?

Re: Expedition SonicWall Support?

DelvinC — Wed, 17 Apr 2019 23:53:21 GMT

@KenLynch What migration tool did you use for this? The old one or Expedition? Also did you come across a SonicReader version later than 0.7? Thanks in advance!

Re: Expedition SonicWall Support?

sjanita — Thu, 18 Apr 2019 07:35:15 GMT

Delvin.C

If you can capture (to a text file) the sonicwall config from the output of the command:

admin@sonicwall> show current-config

I can test the migration against some internal tools being developed.

send an email to fwmigrate (at) paloaltonetworks.com

Re: Expedition SonicWall Support?

KenLynch — Thu, 18 Apr 2019 12:02:45 GMT

I could not find and download the old tool. It was removed from production I think. The new Expedition tool looked not quite ready for production at the time of my migration. We eneded up hiring a very talented consultant named Shawn who helped us through the proces.

Re: Expedition SonicWall Support?

bspilde — Thu, 18 Apr 2019 12:32:39 GMT

I think it would have but purchasing FortiConverter was not approved. I ended up going line for line manually with the Fortinet admin from the acquired company. Turned out much of the config wasn’t required anyway so it was a good audit as well.

Re: Expedition SonicWall Support?

LCMember4723 — Thu, 20 Jun 2019 20:07:12 GMT

How did those internal tools handle the sonicwall configuration?

Re: Expedition SonicWall Support?

DelvinC — Thu, 20 Jun 2019 20:21:51 GMT

The internal tools did help parse the Sonicwall configuration, however since there is a significant technology/style difference between PAN and Sonciwall, you'll need to do a considerable amount of validation to ensure everything migrated and also a comprehensive SIT / UAT plan. Going from SonicWall's VPN clients to GlobalProtect can also be tricky since they are configured differently on their respective platforms.

Re: Expedition SonicWall Support?

LCMember4723 — Thu, 20 Jun 2019 20:36:41 GMT

Thanks Delvin, Seems like my experiences have been similar to yours.

Re: Expedition SonicWall Support?

JohnMaki — Sun, 23 Jun 2019 19:44:24 GMT

We are going through a massive SonicWall to PAN migration with a client currently and I have been trying to find anything to help. I am going to give this a shot and see how it works. Will update if i find anythign out.

Re: Expedition SonicWall Support?

LCMember4723 — Sun, 23 Jun 2019 20:17:42 GMT

I've done several the old fashioned way, exporting everything to ms excel worksheets and then converting to txt and modifing to cli scripts etc... I was going to test a old migration using the forti converter and then import into expedition. I just need to make sure that the forti converter preserves all of the static routes and objects correctly. The most important part of these sonicwall migrations is to "validate" everything which can be time consuming. Clients who did't want to perform that detailed comparrision failed (had major issues and had to roll back) their migrations.

Re: Expedition SonicWall Support?

JohnMaki — Fri, 28 Jun 2019 18:43:28 GMT

So here is the latest scoop. My RE onsite was able to have one of the scripting ninjas somewhere in the deep dark reaches of Palo Corporate and was able to generate csv files containing different information groupings like address, services, interfaces... etc etc etc. I was able to import these into Expedition just fine. That is as far as i have gotten so far. Hopefully that update to Expedition to add this functionality isn't far off!

Re: Expedition SonicWall Support?

jlieberman — Tue, 19 Nov 2019 21:14:03 GMT

I am starting a sonicwall to PAN migration and I am having issues getting the sonicwall.exp file into a csv file. I open the .exp file in the SonicReader v0.7 and get an error " Could not properly parse configtext; Hashes are empty!" . I still am able to view the raw text. When I try and view the HTML report I just see "Please wait. Processing..." and never get a html file. How to proceed with this? Is there another way to get the .exp or raw text file into a tabled format that could be used as a csv to import into expedition? Any help on this would be greatly appreciated.

Re: Expedition SonicWall Support?

jlieberman — Tue, 19 Nov 2019 21:25:26 GMT

Looks like I am able to get an html output with tables using the SonicReader v0.5. Still looking for any other tips that would help a migration from SonicWall to PAN.

Re: Expedition SonicWall Support?

swaschkut — Wed, 12 Oct 2022 14:32:30 GMT

for the Sonicwall Config export, please follow the following CLI way:

1) login via SSH
2) no cli pager session

3) show current-config

with this you can work with the existing script to generate a CSV.
EDIT: 20221012

~~But we are already working on an BETA script, which is not publish yet.~~

regards

Sven

Re: Expedition SonicWall Support?

jlieberman — Wed, 04 Dec 2019 19:41:02 GMT

Thank you Sven for the tips. You mention existing scripts. When can I find those? Any chance to test out the beta script as well. Would be happy to report on my experience with it to help with the debug and improvement. Thank you for your time on this matter,

Re: Expedition SonicWall Support?

swaschkut — Wed, 12 Oct 2022 14:33:45 GMT

EDIT: 20221012
~~as mention the tool is underdevelopment but you can of course ping me via mail and I will send you the installation instructions plus the tool itself.~~

statement is no longer correct

regards

Sven