IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

Reply
Highlighted
L3 Networker

IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

I have a couple of Cisco ASA tunnels I need to convert to Pan. Each has about 200 lines of config all told. Whether I mark things up in a word processor or enter it in PAN gui - it's going to be a slog. Pausing to ask the community: Might there be a conversion utility out there that could help me speed the plow??

Highlighted
L4 Transporter

Re: IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

honestly, I'd strongly consider just rebuilding them manually within PA.

 

nothing automated as far as I'm aware, but I'm sure it's technically possible with the API. Even the migration utility skips VPN migration, in part because by default the pre-shared key is masked when submitting the show run.

--
CCNA Security, PCNSE7
Highlighted
L7 Applicator

Re: IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

Migration tool supports VPN migration from Cisco ASA.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE (3.0, 5.0, 6.0, 7.0), PCNSE (6, 7), PCNSI
Highlighted
L3 Networker

Re: IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

Where do you find such migration tools?

Highlighted
L7 Applicator

Re: IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

https://live.paloaltonetworks.com/t5/Migration-Tool/ct-p/migration_tool

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE (3.0, 5.0, 6.0, 7.0), PCNSE (6, 7), PCNSI
Highlighted
L4 Transporter

Re: IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

 Whilst you can use the migration tool to copy over the VPNs, I have found that often Cisco ASA devices use poor encryption methods by default and these are not changed. Also they are usually set in a policy-based VPN mode. Depending on how you want to play it, you may be better off starting from scratch and creating proper route-based VPNs on both sides of the tunnel and forgoing the need for long lists of proxy IDs.

 

In my experience I have found it more trouble than what is is worth when using the migration tool to move over VPNs from ASAs and have always re-created them manually using lovely excel spreadsheets and concatenate forumula to produce the CLI configuration commands for me. Alternatively if you're a decent scripter you could use the API to make it even easier.

 

hope this helps,

Ben

 

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!