Download the Migration Tool

by panagent on ‎03-23-2015 11:13 AM - edited on ‎05-30-2018 11:46 PM by Community Manager (262,141 Views)


The Palo Alto Networks Migration Tool is derived from the successful Migration Tool used by the Palo Alto Networks Professional Services Organization and Channel Partners. It’s an evolution of the Migration Tool into a configuration platform that allows you to, not only migrate configurations, but enhance, optimize, add, remove or edit elements, ultimately converting the legacy device rules into a next-generation model by creating App-IDs based on real traffic acquired from devices being installed or already in production. The Palo Alto Networks Migration Tool is a valuable asset for network security administrators who need or want to keep their rulebases in a pristine state.

Note: The Migration Tool is packaged as a virtual machine image. The download file is a zipped tar archive and the size is approximately 760MB.


Palo Alto Networks Community Members with Support Accounts

Community members who have a valid support account can download Migration Tool 3.3 (ensure you're logged on at the top of this page before attempting the download)

Click here to get the Migration Tool for VMware ESXi 5.5 (or higher) (updated to 3.3.10)
Click here to get the Migration Tool for VMplayer and Workstation


Don't Have a Support Account?

If you do not have a support account with us, then click the link below:


Click here to download Migration Tool 3.1



Please be aware the Migration Tool is provided as is, and is unsupported by our TAC. Assistance can be garnered through the Migration Tool Discussion Forum or by an onsite Professional Services Engineer, through your local sales contact.

by DavidStrydom
on ‎03-31-2015 08:19 AM

Same here..  been hunting everywhere for the solution.

any luck?

by DavidStrydom
on ‎03-31-2015 08:58 AM

True story.    I extracted the file again using 7zip and then I could see the vmdk files.     Boots in vmware workstation would not boot on ESX immediately but I am sure a export will work.

by scheng
on ‎03-31-2015 09:16 AM


To uncompress the PanMigrationTool3i.tgz file, run the following command:

$ tar -zxvpf PanMigrationTool3i.tgz


by alestevez
on ‎03-31-2015 09:56 AM
by alestevez
on ‎03-31-2015 09:59 AM

We will provide a OVF files soon. But you can always convert the vmdk files to be added to ESXi How to migrate a VMWare Workstation VM to ESXi

Hope it helps

by JoC_VZ
on ‎03-31-2015 11:30 AM

I was able to get PMT3 running on both my VMware Workstation and ESXi5.5 (use VMware Converter Standalone Ed. to convert the VM to ESXi5.5).

However, when I try to import the SRX config file (output via "show config | display xml | no-more"). It keep saying "XML is invalid. (Tip:Remove attributes from configuration tag)". I added <Configuration> and </Configuration> on first and last line. It is still invalid.

How can I do this? "

The file has to start with tag configuration without attributes and end closing the configuration tag"

by alestevez
on ‎03-31-2015 12:35 PM

Try to open the xml file in firefox fir example and see how valid is your xml

Remember to always upgrade your MT3.0 before to do anything


by JoC_VZ
on ‎03-31-2015 04:14 PM

I found I must use "show configuration | display xml | save my-srx-config-file.xml" then scp the file out the SRX. If I do "show configuration | display xml | no-more" then capture the text output. It will NOT show up as a XML complaint file. When I compare two output, they are different. I can read the SRX config into MT3 now.

by alestevez
on ‎03-31-2015 05:42 PM

Thaks for let us know, really helpful.

on ‎03-31-2015 08:23 PM

I tried to extract the file, but only see 1 file inside which is not vmdk file. is there any other file i can download?

by NarasimhaRaju
on ‎04-02-2015 06:04 AM

I extracted the file twice using 7zip and then I could see the vmdk files. But the files are not working with Vmware player.

And also please confirm is it 32 bit version or 64 bit version software?

by DavidStrydom
on ‎04-02-2015 06:10 AM

Looks to be a 64-bit OS.    It worked for me in VMWare Workstation, I have not tried player. 

by NarasimhaRaju
on ‎04-02-2015 06:13 AM

Thanks for the update and I will try Installing in VMWare Workstation.

by FCalderone
on ‎04-04-2015 10:30 AM

I've downloaded and used the command tar -zxvpf PanMigrationTool3i.tgz to uncompress the file on my Mac running VMFusion.  But when I attempt to open the uncompressed PAN_Migration_Tool_Minimal instance I get 'VMX file is corrupt'.  I've tried twice now and both times get the same error.  Any ideas?

by alestevez
on ‎04-04-2015 02:37 PM


please if after use "tar -xvzf PanMigrationTool3i.tgz" and then with fusion 6 or later you are not able to run the vm please download the vm again, its working for a lot of people, maybe the download was corrupted, please confirm if this works for you


by FCalderone
on ‎04-04-2015 06:16 PM


I've tried multiple times now, with Safari, Chrome, and Firefox browsers and all downloads give me the same result that the VMX file is corrupt.  I've tried downloading as a community user and as a non-community user both with the same result the file is corrupt.  I am using VM Fusion 7.  I've stopped and started VM Fusion and that has not worked either.

by alestevez
on ‎04-05-2015 10:47 AM


Im so sorry to hear that. Can you confirm that, once you have uncompressed the file and you get the folder PAN_Migration_Tool_Minimal you open the VMfusion 7, click on File -> Open and then Select the FolderPAN_Migration_Tool_Minimal and click on Open. tell me if then you get the error or opens the VM please, Can you send us an screenshot with the error?


by rroger
on ‎04-14-2015 09:35 AM

Hello alestevez, i've tried to boot on VM Worsktation 9.0, but it says that is uncompatible with my VmWare version.

Migration_tool.pngDo you have a solution fo that

by alestevez
on ‎04-14-2015 11:48 AM


Those are the minimum requirements

Screen Shot 2015-04-14 at 20.44.04.png

But I think you can change them from Settings, Compatibility and then changing here the Hardware version to 9, or just upgrade to Workstation 10.

Hope it helps

by jferguson
on ‎04-16-2015 01:05 PM

So interestingly enough, when I download the Migration tool file from:

I get a block on my AV stating that it is infected with Win32:Crypt-QRI [Trj]


by rroger
on ‎04-17-2015 02:31 AM

Hello alestevez, i found the solution to my problem. I open the vmx file with notepad++ and just change the parameter virtualHW.version to match my VmWareWorkstation version...:smileyhappy:

and it works.


by jkw117
on ‎05-08-2015 08:22 AM

I have an ASA at 8.2 which is right below the version supported by the Migration tool 3 we don't want to upgrade it because we'd need to rebuild the NAT's and a whole host of other things in order to upgrade and then probably have to do it again when migrating to the PA-3020. According to the notes/Docs we should use the migration tool version 2.5 import it into that, export it from there and then into the 3.0. So the question is where can I get version 2.5?

Also as a side note I tried to import the asa config into the 3.0 migrator. But I get a lot of errors with the IP service where it doesn't recognize the service. How do I go about resolving that?

by alestevez
on ‎05-11-2015 01:24 AM


The Old migration tool 2.5 can import only a selection of static nats. Only when the nat is created as "static (zone,zone) xxx xxxx" without any reference to interfaces or access-list.

Remember the Migration Tool its only a part of a migration project where Technology, Process and People an required to achieve that, the Tool is obviously the Technology but in order to migrate you need to have the right process and people with knowledge to do that and help to cover the things that the tool doesn't do automatically today.

hope it helps

by JGWPT201
on ‎06-03-2015 05:58 AM


Have you guys created a ovf template for the migration tool?

by alestevez
on ‎06-04-2015 12:25 AM


We didn't yet but is plenty of docs in our community explaining how others did it before.

Hope it helps

by kokumura
on ‎06-11-2015 03:44 PM

I get the same message when my antivirus blocks my download. Did you find out anything or do anything different to get the file downloaded?

by JGWPT201
on ‎06-15-2015 12:20 PM

I just downloaded it from the site I didn't have any problem downloading it will my anti-virus.  Maybe just disable your anti-virus so you can download it, it is a valid download since it is coming from palo alto website.  Hope that helps.

by jithuraj
on ‎07-12-2015 11:29 AM

Do we have an option to migrate rules from Firewalls to Panorama in this tool?

by alestevez
on ‎07-12-2015 11:31 AM


Yes, import your firewall config, then import your panorama as Base Config, create the devicegroup and drag and drop the rules and objects from your firewall to your new devicegroup in Panorama, click merge, that's it. Regards

by jithuraj
on ‎07-12-2015 11:34 AM

Thank You :smileyhappy:

by vtugade
on ‎07-13-2015 11:04 PM

Is there a way to make the migration tool 3.x instead of DHCP to static ip address?

This was simple in 2.5 because we could do this via WEBMIN.

Or allow SUDO permssions to vi /etc/sysconfig/network-scripts/ifgcfg-<ens33>.cfg file?

by alestevez
on ‎07-14-2015 01:12 AM
by pecheurer
on ‎07-22-2015 03:05 AM


I extracted the .tar file with success on my ESXi.

I can see all followings files: Virtual Disk-s001 to -011.vmdk

I can see following file too: Virtual Disk.vmdk (size about 974o)

When I power UP my VM, Virtual Disk.vmdk is no found.

I execute the followinf task :How to migrate a VMWare Workstation VM to ESXi

But, I have the same error: Virtual Disk.vmdk is no found (but is present when I execute ls -l).

I tested to create a new VM but it's the same....

What is my mistake please ?



by alestevez
on ‎07-22-2015 03:09 AM


Have you used this command?

vmkfstools -i "Virtual Disk.vmdk" -d thin newesx.vmdk

by pecheurer
on ‎07-22-2015 03:22 AM


Yes !

with the following error:

The system cannot find the file specified (25)

by alestevez
on ‎07-22-2015 03:27 AM

Have you executed this command first?

vmkload_mod multiextent

by pecheurer
on ‎07-22-2015 05:37 AM

C'est ok. Je vous remercie.

by alestevez
on ‎07-22-2015 05:39 AM

It worked?

by pecheurer
on ‎07-22-2015 05:42 AM

Yes !

Thanks you very much for the previous command (vmkload_mod multiextent) .


by AllynBrown
on ‎11-16-2015 05:50 PM

Running Wrokstation version 8 and modifying this file .vmx `virtualHW.version` for the version does the trick for me. Thanks!

by paul.marroquin.01
on ‎12-01-2015 09:03 AM

 Is there a 32-bit build of the migration tool? We are having issues running the 64-bit image.


by alestevez
on ‎12-04-2015 04:13 AM

Sorry the OS is in 64bits as well. What kind of issues if I may ask?

by manwithonename
‎06-06-2016 11:33 PM - edited ‎06-06-2016 11:41 PM

I found I must use "show configuration | display xml | save my-srx-config-file.xml" then scp the file out the SRX. If I do "show configuration | display xml | no-more" then capture the text output. It will NOT show up as a XML complaint file. When I compare two output, they are different. I can read the SRX config into MT3 now.


just an FYI, finally found success getting past the "invalid xml" error. First I followed the above steps, but even with this file I was still receiving the invalid xml errors which annoyed the heck outta me. 


Steps to take:

-find and remove any junos:comments like the line shown below. Seems the MT performs an XML validation and it does not understand the syntax of these tags. 


<junos:comment>/* randomcomment */</junos:comment>


-start a new project: don't continue to use a failed import as it seems somethings gets stuck in the MT and it cannot get past it. After starting a new project with the edited xml file the MT imported and converted the migrated SRX policies. 




by calonso
on ‎11-01-2016 11:42 AM

The Migration tools can run in one Virtual Machine Hyper-V?


by taionalaja
on ‎01-17-2017 11:19 AM

How do I assign IP address to my VMware?

by alestevez
on ‎01-25-2017 02:20 AM

sudo nmtui

by JigarPatel
on ‎04-26-2017 11:15 AM

we have the tool installed on a centos 2vcpu and 2gb RAM. Is that the ideal specifications for the VM ? Everytime i use the tool for app-id adoption, when i try to retreive the application from the panorama(using it as a log collector) it just freezes. Any idea ?

by andrew.infante
on ‎06-14-2017 10:33 AM

I was told to message Albert to get a copy of v1.8 of the migration tool.  I am in process of converting sonicwall and was told that will do it partially.  Please reply or send me the link to download.





by damonpeterson
on ‎08-03-2017 08:23 AM

Is there a reason I cannot download this?  We have an account and are logged. it. 

by khushalwaghela
on ‎09-01-2017 03:19 AM

Many thanks to Palo Alto for creating this tool!!

This download works for me on VMware workstation 12 

Just go to File > Open and select the file 'PAN_MigrationTool_minimal.vmx' from extracted contents.