topic Re: Expedition tool for ASA migration in Expedition Discussions

Expedition tool for ASA migration

AK74 — Sun, 08 May 2022 21:55:25 GMT

Hi there,

We need to migrate from Cisco ASA (HA Pair Active/Standby) with multi-context (3 contexts) to Palo Alto vsys.

What’s the best approach and effective way to accomplish this task?

I’ve looked into Expedition tool, but not sure if it’s really good and accurate method for such a task.

Thanks.

Re: Expedition tool for ASA migration

Y-alwaysMe — Sun, 08 May 2022 22:54:23 GMT

Expedition is extremely useful migration tool. if you create your vsys on the PA and configure HA and DG.

You can use expedition to migrate each sec/nat/ policy and objects to the specific Device group. if your policies are small like 50 sec policies or less than it might be better to migrate it manually without Expedition.. I only say manual because once the policy is on the PA someone that understand both Asa and Pa configuration needs to review the sec and nat policy and make any corrections manually.

https://www.youtube.com/watch?v=-gbQ-YcgoPs

https://www.youtube.com/watch?v=ueU_Gus6wGI&list=PLu-orFl0GVdfKP9fV8ffQNpzG1XdsaK7i&index=7

Re: Expedition tool for ASA migration

SteveKrall — Tue, 10 Jan 2023 19:04:22 GMT

This is the sequence and the answers I was given from the "fwmigrate" team.

It is possible to to convert a Cisco multi-context firewall into multiple virtual routers or multiple virtual systems.

For export of cisco multi-context config , you will need to go into each of the context first:

changeto context <name>changeto system

and run the commands below

terminal pager 0

more system:running-config / show running

here are the instructions :

https://pan.dev/expedition/docs/expedition_export/#cisco

You will need to save the content of each context in a different file, for example, you have 4 contexts on cisco asa , then you will export them into 4 files , then in expedition, you can zip all 4 files in a zip file and import it as zip. If you prefer to work on one context at a time, then you can import one config at a time.

I will verify that this works in the next few days.

Re: Expedition tool for ASA migration

Jenifa — Thu, 25 Jan 2024 12:26:06 GMT

Hi, Can you please provide 'FWMigrate' team's email address?