topic Re: Migrate VPNs from ASA in Expedition Discussions

Migrate VPNs from ASA

WRibeiro — Thu, 24 Jan 2019 15:26:26 GMT

Hi Guys,

I'm migrating to a PA 3220 running PAN-OS 8.1.5. I migrated the Cisco config using the migration tool 3.3.10.

Policies, Zones, Interfaces, NATs, everything was migrated. However, site to site VPNs weren't.

Doesn't the migration tool migrate site to site VPNs?

Am I missing something?

Thanks.

Re: Migrate VPNs from ASA

bagherib — Thu, 24 Jan 2019 15:30:49 GMT

Have you tried this in Expedition? MT3 has not been updated in years and will not be.

Your S2S tunnels should migrate.

Re: Migrate VPNs from ASA

WRibeiro — Thu, 24 Jan 2019 16:22:57 GMT

I'm going to install Expedition and migrate again. Thanks.

Re: Migrate VPNs from ASA

WRibeiro — Mon, 28 Jan 2019 10:43:56 GMT

Hi mate,
unfortunately, it didn't work either using Expedition. None IPSec tunnel was imported

Any idea?

Re: Migrate VPNs from ASA

dgildelaig — Mon, 28 Jan 2019 15:25:17 GMT

Can you contact us at fwmigrate at paloaltnetworks dot come to check it further?

Expedition should be able to import your VPNs, so we will check it.

Re: Migrate VPNs from ASA

HalEden — Tue, 11 Feb 2020 01:46:00 GMT

it would be good to hear the general outcome of such exchanges.

i realize that you shouldn't reveal sensitive information, but tips on what the problem was and the general resolution would help others greatly.

thanks

Re: Migrate VPNs from ASA

abarbany — Tue, 11 Feb 2020 08:59:24 GMT

The cisco parser in Expedition has been improved to understand and include more types of VPNs.

In the newest versions of Expedition this should be fixed.

Re: Migrate VPNs from ASA

HalEden — Wed, 12 Feb 2020 04:09:12 GMT

thanks, that helps the rest of us know what happened.

i had a different problem: the VPNs migrated, but they were all invalid.

finally figured out that the IKE profiles weren't assigned so i had to select them then they were okay.

i had to figure this out myself: are there any guides that would have given me a clue?

thanks

Re: Migrate VPNs from ASA

abarbany — Wed, 12 Feb 2020 09:17:33 GMT

You can check the migration workflow guide here:

https://live.paloaltonetworks.com/t5/Expedition-Articles/Expedition-User-Guide-v1-2/ta-p/285157

Also you can send an email to fwmigrate at paloaltnetworks dot come to check this problem further.

Re: Migrate VPNs from ASA

dgildelaig — Wed, 12 Feb 2020 10:17:14 GMT

Most probably that piece of information is not updated in your Manual.

Sorry for not having it updated enough.

Re: Migrate VPNs from ASA

HalEden — Wed, 12 Feb 2020 14:05:22 GMT

yes, i used the guide, but it didn't say much about VPNs.

will keep in mind the option of fwmigrate dot com

thanks

Re: Migrate VPNs from ASA

HalEden — Wed, 12 Feb 2020 14:11:24 GMT

don't get me wrong, it did a great job of converting overall. the logs were helpful, just had to figure out the correlation.

one thing: with the NAT rules, the warnings were connected when i edited, but not on the VPN, so it took me longer to track down the connection.

thanks

Re: Migrate VPNs from ASA

dgildelaig — Thu, 13 Feb 2020 14:51:34 GMT

Thanks,

I will take a look into this