topic Re: Migration from FTD 2110 HA pair to PA 3410 pair. in Expedition Discussions

Migration from FTD 2110 HA pair to PA 3410 pair.

HakunaMatata007 — Tue, 09 Jul 2024 14:06:23 GMT

Hello All,

We are about to Migrate from Cisco FTD 2110 HA Pair to PA 3410 HA. Can some one help out with the process.

Does Expedition works well? if Yes what are the steps i need to do? Please let me know.

PA is completely new for us, please let me know what will be the way to do a smooth migration.

Thanks in advance.

Re: Migration from FTD 2110 HA pair to PA 3410 pair.

JayGolf — Tue, 09 Jul 2024 22:03:07 GMT

Hi @HakunaMatata007 ,

I found a relevant discussion for FTD to PAN migrations. Hope this helps!

Re: Migration from FTD 2110 HA pair to PA 3410 pair.

dpuigdomenec — Wed, 10 Jul 2024 08:31:57 GMT

Hi @HakunaMatata007

Expedition can migrate FTD in ASA syntax. First you need to extract the config in ASA syntax and then running the workflow defined in above videos you will be able to migrate to PANOS.

Expedition - Cisco ASA Migration to Palo Alto Networks: https://www.youtube.com/playlist?list=PLD6FJ8WNiIqVez8EBeoyRsnQcKTA5FuZ-
Note that the migration will only apply to L4 rule objects. For more information, check here the support 3rd party migration matrix: https://live.paloaltonetworks.com/t5/expedition-articles/expedition-supported-3rd-party-vendor-matrix/ta-p/336922

Hope this helps,

David

Re: Migration from FTD 2110 HA pair to PA 3410 pair.

HakunaMatata007 — Wed, 10 Jul 2024 13:43:11 GMT

Thankyou for the response David @dpuigdomenec

So what are the ways i can convert my FTD config file to ASA syntax file. Any info or steps that i need to do please.

Thankyou

Re: Migration from FTD 2110 HA pair to PA 3410 pair.

HakunaMatata007 — Wed, 10 Jul 2024 13:45:07 GMT

@JayGolf thankyou for the information.

Re: Migration from FTD 2110 HA pair to PA 3410 pair.

dpuigdomenec — Wed, 10 Jul 2024 15:58:45 GMT

Hi @HakunaMatata007

To be honest with you I didn't execute the commands as my customers did that for me.

Doing some google I found this article that maybe help: https://community.cisco.com/t5/network-security/how-show-running-configuration-or-startup-configuration/td-p/4523162

On the other hand, I've escalated the question to my PS colleagues. I will let you know once I have a response.

Hope this help,

David