IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

L3 Networker

I have a couple of Cisco ASA tunnels I need to convert to Pan. Each has about 200 lines of config all told. Whether I mark things up in a word processor or enter it in PAN gui - it's going to be a slog. Pausing to ask the community: Might there be a conversion utility out there that could help me speed the plow??

5 REPLIES 5

L4 Transporter

honestly, I'd strongly consider just rebuilding them manually within PA.

 

nothing automated as far as I'm aware, but I'm sure it's technically possible with the API. Even the migration utility skips VPN migration, in part because by default the pre-shared key is masked when submitting the show run.

--
CCNA Security, PCNSE7

Migration tool supports VPN migration from Cisco ASA.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Where do you find such migration tools?

https://live.paloaltonetworks.com/t5/Migration-Tool/ct-p/migration_tool

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

 Whilst you can use the migration tool to copy over the VPNs, I have found that often Cisco ASA devices use poor encryption methods by default and these are not changed. Also they are usually set in a policy-based VPN mode. Depending on how you want to play it, you may be better off starting from scratch and creating proper route-based VPNs on both sides of the tunnel and forgoing the need for long lists of proxy IDs.

 

In my experience I have found it more trouble than what is is worth when using the migration tool to move over VPNs from ASAs and have always re-created them manually using lovely excel spreadsheets and concatenate forumula to produce the CLI configuration commands for me. Alternatively if you're a decent scripter you could use the API to make it even easier.

 

hope this helps,

Ben

 

 

 

  • 2270 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!