topic Is there tool available to sync the config from physical Paloalto on-premise the disaster recovery site in Azure? in Next-Generation Firewall Discussions

Is there tool available to sync the config from physical Paloalto on-premise the disaster recovery site in Azure?

farshadhadei — Fri, 25 Aug 2023 22:46:20 GMT

We have onpremise network and paloalto firewalls and zone base zero trust config and we want to have the DR in Azure on virtual firewalls and looking for the way to convert and sync the config from on-premise physical firewalls to Azure virtual firewalls. I know there are some magic need to be done to convert vlans to subnets/vnets and update all firewall policies, etc...

Is it feasible and if yes is there any available tool/utility that we can use to sync the firewall config in a daily basis? or automate it?

Best,

Re: Is there tool available to sync the config from physical Paloalto on-premise the disaster rec...

JayGolf — Wed, 30 Aug 2023 16:39:00 GMT

Hi @farshadhadei ,

I don't know if there is a tool that will automatically do that for you, but what you can do is use the Expedition migration tool and convert the network settings and policies to your liking.

Re: Is there tool available to sync the config from physical Paloalto on-premise the disaster recovery site in Azure?

BPry — Wed, 30 Aug 2023 16:53:21 GMT

@farshadhadei,

Best bet since you want this to happen regularly is to automate it by migrating your configuration efforts to modifying the XML directly (or having it done via a scripted pull of the config) and using Jinja2 to handle the templating where necessary (like replacing everything in <deviceconfig>).

An example of a what this would look like from a config standpoint would be like so:

<deviceconfig> {% include [deviceconfig] %} </deviceconfig>

Then when you render the configuration file to be uploaded and loaded onto the device what you would do is simply include that device's specific configuration with that deviceconfig variable. Mirroring that basic concept for anything that you wish to template within the configuration file, such as targeted IPs, specific interfaces, certain rulebase aspects and so forth.

Re: Is there tool available to sync the config from physical Paloalto on-premise the disaster recovery site in Azure?

farshadhadei — Wed, 30 Aug 2023 17:33:51 GMT

thanks for the solution @BPry . I'm planning to test it in our lab environment next week and will let you know the result

Re: Is there tool available to sync the config from physical Paloalto on-premise the disaster rec...

farshadhadei — Wed, 30 Aug 2023 17:35:54 GMT

Thanks @JayGolf , I think it's good solution for the migration or short them, I'm not sure if we can automate the expedition tool runs based on template or something, I will do more research to see if the tool supports it