Download the Migration Tool

Printer Friendly Page


The Palo Alto Networks Migration Tool is derived from the successful Migration Tool used by the Palo Alto Networks Professional Services Organization and Channel Partners. It’s an evolution of the Migration Tool into a configuration platform that allows you to, not only migrate configurations, but enhance, optimize, add, remove or edit elements, ultimately converting the legacy device rules into a next-generation model by creating App-IDs based on real traffic acquired from devices being installed or already in production. The Palo Alto Networks Migration Tool is a valuable asset for network security administrators who need or want to keep their rulebases in a pristine state.

Note: The Migration Tool is packaged as a virtual machine image. The download file is a zipped tar archive and the size is approximately 760MB.


Palo Alto Networks Community Members with Support Accounts

Community members who have a valid support account can download Migration Tool 3.3 (ensure you're logged on at the top of this page before attempting the download)

Click here to get the Migration Tool for VMware ESXi 5.5 (or higher) (updated to 3.3.10)
Click here to get the Migration Tool for VMplayer and Workstation


Don't Have a Support Account?

If you do not have a support account with us, then click the link below:


Click here to download Migration Tool 3.1



Please be aware the Migration Tool is provided as is, and is unsupported by our TAC. Assistance can be garnered through the Migration Tool Discussion Forum or by an onsite Professional Services Engineer, through your local sales contact.

Tags (2)

Same here..  been hunting everywhere for the solution.

any luck?

True story.    I extracted the file again using 7zip and then I could see the vmdk files.     Boots in vmware workstation would not boot on ESX immediately but I am sure a export will work.


To uncompress the PanMigrationTool3i.tgz file, run the following command:

$ tar -zxvpf PanMigrationTool3i.tgz


We will provide a OVF files soon. But you can always convert the vmdk files to be added to ESXi How to migrate a VMWare Workstation VM to ESXi

Hope it helps

I was able to get PMT3 running on both my VMware Workstation and ESXi5.5 (use VMware Converter Standalone Ed. to convert the VM to ESXi5.5).

However, when I try to import the SRX config file (output via "show config | display xml | no-more"). It keep saying "XML is invalid. (Tip:Remove attributes from configuration tag)". I added <Configuration> and </Configuration> on first and last line. It is still invalid.

How can I do this? "

The file has to start with tag configuration without attributes and end closing the configuration tag"

Try to open the xml file in firefox fir example and see how valid is your xml

Remember to always upgrade your MT3.0 before to do anything


I found I must use "show configuration | display xml | save my-srx-config-file.xml" then scp the file out the SRX. If I do "show configuration | display xml | no-more" then capture the text output. It will NOT show up as a XML complaint file. When I compare two output, they are different. I can read the SRX config into MT3 now.

Thaks for let us know, really helpful.

I tried to extract the file, but only see 1 file inside which is not vmdk file. is there any other file i can download?

I extracted the file twice using 7zip and then I could see the vmdk files. But the files are not working with Vmware player.

And also please confirm is it 32 bit version or 64 bit version software?

Looks to be a 64-bit OS.    It worked for me in VMWare Workstation, I have not tried player. 

Thanks for the update and I will try Installing in VMWare Workstation.

I've downloaded and used the command tar -zxvpf PanMigrationTool3i.tgz to uncompress the file on my Mac running VMFusion.  But when I attempt to open the uncompressed PAN_Migration_Tool_Minimal instance I get 'VMX file is corrupt'.  I've tried twice now and both times get the same error.  Any ideas?


please if after use "tar -xvzf PanMigrationTool3i.tgz" and then with fusion 6 or later you are not able to run the vm please download the vm again, its working for a lot of people, maybe the download was corrupted, please confirm if this works for you



I've tried multiple times now, with Safari, Chrome, and Firefox browsers and all downloads give me the same result that the VMX file is corrupt.  I've tried downloading as a community user and as a non-community user both with the same result the file is corrupt.  I am using VM Fusion 7.  I've stopped and started VM Fusion and that has not worked either.


Im so sorry to hear that. Can you confirm that, once you have uncompressed the file and you get the folder PAN_Migration_Tool_Minimal you open the VMfusion 7, click on File -> Open and then Select the FolderPAN_Migration_Tool_Minimal and click on Open. tell me if then you get the error or opens the VM please, Can you send us an screenshot with the error?


Hello alestevez, i've tried to boot on VM Worsktation 9.0, but it says that is uncompatible with my VmWare version.

Migration_tool.pngDo you have a solution fo that


Those are the minimum requirements

Screen Shot 2015-04-14 at 20.44.04.png

But I think you can change them from Settings, Compatibility and then changing here the Hardware version to 9, or just upgrade to Workstation 10.

Hope it helps

So interestingly enough, when I download the Migration tool file from:

I get a block on my AV stating that it is infected with Win32:Crypt-QRI [Trj]


Hello alestevez, i found the solution to my problem. I open the vmx file with notepad++ and just change the parameter virtualHW.version to match my VmWareWorkstation version...:smileyhappy:

and it works.


I have an ASA at 8.2 which is right below the version supported by the Migration tool 3 we don't want to upgrade it because we'd need to rebuild the NAT's and a whole host of other things in order to upgrade and then probably have to do it again when migrating to the PA-3020. According to the notes/Docs we should use the migration tool version 2.5 import it into that, export it from there and then into the 3.0. So the question is where can I get version 2.5?

Also as a side note I tried to import the asa config into the 3.0 migrator. But I get a lot of errors with the IP service where it doesn't recognize the service. How do I go about resolving that?


The Old migration tool 2.5 can import only a selection of static nats. Only when the nat is created as "static (zone,zone) xxx xxxx" without any reference to interfaces or access-list.

Remember the Migration Tool its only a part of a migration project where Technology, Process and People an required to achieve that, the Tool is obviously the Technology but in order to migrate you need to have the right process and people with knowledge to do that and help to cover the things that the tool doesn't do automatically today.

hope it helps


Have you guys created a ovf template for the migration tool?


We didn't yet but is plenty of docs in our community explaining how others did it before.

Hope it helps

I get the same message when my antivirus blocks my download. Did you find out anything or do anything different to get the file downloaded?

I just downloaded it from the site I didn't have any problem downloading it will my anti-virus.  Maybe just disable your anti-virus so you can download it, it is a valid download since it is coming from palo alto website.  Hope that helps.

Do we have an option to migrate rules from Firewalls to Panorama in this tool?


Yes, import your firewall config, then import your panorama as Base Config, create the devicegroup and drag and drop the rules and objects from your firewall to your new devicegroup in Panorama, click merge, that's it. Regards

Thank You :smileyhappy:

Is there a way to make the migration tool 3.x instead of DHCP to static ip address?

This was simple in 2.5 because we could do this via WEBMIN.

Or allow SUDO permssions to vi /etc/sysconfig/network-scripts/ifgcfg-<ens33>.cfg file?


I extracted the .tar file with success on my ESXi.

I can see all followings files: Virtual Disk-s001 to -011.vmdk

I can see following file too: Virtual Disk.vmdk (size about 974o)

When I power UP my VM, Virtual Disk.vmdk is no found.

I execute the followinf task :How to migrate a VMWare Workstation VM to ESXi

But, I have the same error: Virtual Disk.vmdk is no found (but is present when I execute ls -l).

I tested to create a new VM but it's the same....

What is my mistake please ?




Have you used this command?

vmkfstools -i "Virtual Disk.vmdk" -d thin newesx.vmdk


Yes !

with the following error:

The system cannot find the file specified (25)

Have you executed this command first?

vmkload_mod multiextent

C'est ok. Je vous remercie.

It worked?

Yes !

Thanks you very much for the previous command (vmkload_mod multiextent) .


Running Wrokstation version 8 and modifying this file .vmx `virtualHW.version` for the version does the trick for me. Thanks!

 Is there a 32-bit build of the migration tool? We are having issues running the 64-bit image.


Sorry the OS is in 64bits as well. What kind of issues if I may ask?

I found I must use "show configuration | display xml | save my-srx-config-file.xml" then scp the file out the SRX. If I do "show configuration | display xml | no-more" then capture the text output. It will NOT show up as a XML complaint file. When I compare two output, they are different. I can read the SRX config into MT3 now.


just an FYI, finally found success getting past the "invalid xml" error. First I followed the above steps, but even with this file I was still receiving the invalid xml errors which annoyed the heck outta me. 


Steps to take:

-find and remove any junos:comments like the line shown below. Seems the MT performs an XML validation and it does not understand the syntax of these tags. 


<junos:comment>/* randomcomment */</junos:comment>


-start a new project: don't continue to use a failed import as it seems somethings gets stuck in the MT and it cannot get past it. After starting a new project with the edited xml file the MT imported and converted the migrated SRX policies. 




The Migration tools can run in one Virtual Machine Hyper-V?


How do I assign IP address to my VMware?

sudo nmtui

we have the tool installed on a centos 2vcpu and 2gb RAM. Is that the ideal specifications for the VM ? Everytime i use the tool for app-id adoption, when i try to retreive the application from the panorama(using it as a log collector) it just freezes. Any idea ?

I was told to message Albert to get a copy of v1.8 of the migration tool.  I am in process of converting sonicwall and was told that will do it partially.  Please reply or send me the link to download.





Is there a reason I cannot download this?  We have an account and are logged. it. 

Many thanks to Palo Alto for creating this tool!!

This download works for me on VMware workstation 12 

Just go to File > Open and select the file 'PAN_MigrationTool_minimal.vmx' from extracted contents.

Ask Questions Get Answers Join the Live Community
Version history
Revision #:
17 of 17
Last update:
‎05-30-2018 11:46 PM
Updated by: