topic Re: IPSec Conversion utility for Cisco ASA to PAN 6.1.1? in General Topics

IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

palomed — Thu, 20 Apr 2017 23:02:48 GMT

I have a couple of Cisco ASA tunnels I need to convert to Pan. Each has about 200 lines of config all told. Whether I mark things up in a word processor or enter it in PAN gui - it's going to be a slog. Pausing to ask the community: Might there be a conversion utility out there that could help me speed the plow??

Re: IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

bradk14 — Thu, 20 Apr 2017 23:07:49 GMT

honestly, I'd strongly consider just rebuilding them manually within PA.

nothing automated as far as I'm aware, but I'm sure it's technically possible with the API. Even the migration utility skips VPN migration, in part because by default the pre-shared key is masked when submitting the show run.

Re: IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

Raido_Rattameister — Fri, 21 Apr 2017 03:58:54 GMT

Migration tool supports VPN migration from Cisco ASA.

Re: IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

palomed — Mon, 24 Apr 2017 22:10:22 GMT

Where do you find such migration tools?

Re: IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

Raido_Rattameister — Mon, 24 Apr 2017 22:49:02 GMT

https://live.paloaltonetworks.com/t5/Migration-Tool/ct-p/migration_tool

Re: IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

bmorris1 — Tue, 25 Apr 2017 11:52:34 GMT

Whilst you can use the migration tool to copy over the VPNs, I have found that often Cisco ASA devices use poor encryption methods by default and these are not changed. Also they are usually set in a policy-based VPN mode. Depending on how you want to play it, you may be better off starting from scratch and creating proper route-based VPNs on both sides of the tunnel and forgoing the need for long lists of proxy IDs.

In my experience I have found it more trouble than what is is worth when using the migration tool to move over VPNs from ASAs and have always re-created them manually using lovely excel spreadsheets and concatenate forumula to produce the CLI configuration commands for me. Alternatively if you're a decent scripter you could use the API to make it even easier.

hope this helps,

Ben