Migration Tool 3 Info and Guide

Printer Friendly Page

Migration Tool 3.0 info and Guide


The main objective of the Palo Alto Networks Migration Tool 3.0 is to assist network security administrators, professional consultants, or anyone working on a migration project, rules optimization, security controls validation, APP-ID implementation, as well as deploying these converted or new configurations to devices directly connected to the Palo Alto Networks Migration Tool 3 or by XML files exported as needed.


PLEASE NOTE: This is a Migration Tool, this is NOT a comprehensive Conversion Tool. This tool does not convert everything, it merely aids in the migration from Non-Palo Alto Network devices to Palo Alto Networks devices.


Here is a small list of what is and what is not currently supported when using the Migration Tool version 3.0.


Supported Platforms to import the config from:

  • PAN-OS
  • Cisco
  • Check Point
  • Juniper SRX
  • ScreenOS
  • Fortinet
  • Sidewinder
  • Stonesoft


Supported features:

  • Import NAT rules for Cisco versions 8.3 and older but won’t migrate previous versions
  • Import Twice NAT rules from Cisco devices
  • Count objects inside a group (All Platforms) and will split object groups containing more than 500 objects into smaller groups and will create a single dynamic group pointing to these small groups also changing the security and NAT policies that reference these object groups.
  • Ability to load several “configs,”, merge them into different “config candidates, and then release these new configurations into the PAN-OS 6.X by API calls or by exporting them into common XML file.
  • Ability to merge one or more candidate configurations into a new or preexisting PAN-OS configuration.
  • Ability to import active PAN-OS configurations, and tweak, edit, cut or manipulate the elements, perform a multi-edit throughout the XML elements in yourpresent (imported) configuration file with no code editing necessary.


Un-supported features:

  • Will not import VPNs from any platforms but CISCO ASA.


About the Migration Tool 3 Guide

This guide takes you through the utilization of the new Palo Alto Networks Migration Tool 3. This guide is designed for users with previous knowledge of the PAN-OS platform.


Refer to the following resources for additional information:

  • For support, Please remember the TAC does NOT support this tool. This tool is supported through the Palo Alto Networks Community. Refer to the following link to get the discussions page where you can look for info and post questions if you cannot find what you are looking for: Migration Tool Discussions
  • For information on the additional capabilities of Palo Alto Networks firewalls and for instructions on configuring the features on the firewall, refer to the live homepage at: https://live.paloaltonetworks.com/welcome


31st July 2015 Update:

Please download latest User Guide for Migration Tool 3.1 from MigrationTool 3.1 User Guide


10th Feb 2016 Update:

Please download latest User Guide for Migration Tool 3.3 from MigrationTool 3.3 User Guide

Tags (5)

Did we mean "newer"


  • Import NAT rules for Cisco versions 8.3 and older but won’t migrate previous versions

Version 3.2 has added Nat for older version from 8.3 in Cisci ASA. 

I just recently tried the new migration tool and I am using version 3.5. I am migrating Sidewinder to the Palo's. I found that the "netgroup" file is not loading in the migration tool using the the input method. I did find that when I use the copy/paste method, it loads but only the names not the ip addresses. Any help with this is greatly appreciated.

Hi , I downlaoded the PanMigration Tool31 , and have extrated the files , unfortunately I am not sure on how to run this tool within VMware . I would thought the files downloaded would have a Virtual app to do this . I tried to look into the Pan Migration user guide , but they dont have a section on how to start this process after the download .


Can anyone please guide me in the right direction .







Use this link to give you further instructions. As for the app to use, you will need to download and install VM Player to run the migration tool.




Hope this helps!


hello, i have installed the Pan Migration tool 3.1 and upgraded it and i am trying to access the command line of the actual firewall.   is there a way to access the CLI or grab only portions of the migrated config from another firewall to allow us to build a new PAN manually versus imported the entire config into a new PAN?  we already have our current PANs in vwire and need to make them routed and we want to clean up the old firewall configs in within the migration tool, but cannot do this on the current firewall platform.  any help is greatly appreciated.




I have downloded the tool and got the config uploaded, however when I go to "Create the output" tab and select cofiguration to convert, it stays at initializing. Please can someone confirm how much time does the conversion take and what can be done to fix if this is an issue


Any help would be appreciated,


Thanks in anticipation


Has anyone used Expedition yet (4.0 beta migration tool)?


IF so, is there anyone out there that has done a migration from Checkpoint R80.10?  I am pulling my hair out trying to get it to work as claimed.





Ask Questions Get Answers Join the Live Community
Version history
Revision #:
4 of 4
Last update:
‎10-24-2019 10:37 AM
Updated by: