topic Migration without Expedition in General Topics

Migration without Expedition

MrWonderful — Wed, 23 Sep 2020 17:37:38 GMT

Hello

If I wanted to migrate from Checkpoint to Palo with Panorama, but not use Expedition, what would be the general steps?

Thank you for your time.

Re: Migration without Expedition

BPry — Thu, 24 Sep 2020 01:58:36 GMT

You would essentially be rebuilding the entire configuration and duplicating what you already have configured on the checkpoint. That's actually a good thing in my mind because it gives you a chance to review your existing configuration and only move over what you actually currently need, while also "palotizing" the configuration.

Re: Migration without Expedition

aleksandar.astardzhiev — Thu, 24 Sep 2020 22:33:03 GMT

Hi @BPry ,

Fully agree with the review and the "palotization", but I would still use the Expedition and do the review there. Remove what is not required, replace ports with applications and etc an then generate PAN config.

@MrWonderful "Work smart, not hard" - why would you prefer to waist time and energy in configuring all of the objects and rules when the tool do it for you with a blink of an eyes?

Re: Migration without Expedition

MrWonderful — Mon, 28 Sep 2020 11:57:17 GMT

@aleksandar.astardzhiev Long story short....because my employer is making me do it that way.

Re: Migration without Expedition

aleksandar.astardzhiev — Tue, 29 Sep 2020 08:09:29 GMT

Well @MrWonderful ,

You can still use the Expedition tool to do the bulk work and convert all network objects and apply them on the new firewall. That way you can configure the rules one by one manually. I would still suggest to to use Expedition for the rules, adjust the rules (replace known ports with applications, remove unused rules etc), generate set commands and apply them on the new FW manually.

Re: Migration without Expedition

mmeehan — Wed, 30 Sep 2020 12:32:28 GMT

I would use the Expedition for the initial import and massage the configuration from there. Depending on your DB it's a lot of work to recreate a policy set and you are bound to make some copy/paste errors. With the bulk change tools in Expedition it's easy to change context, names and add policies to zones.