MigrationTool 3.3 Info and Guide

Printer Friendly Page

Version 3.3 is here !!


Attached is the documentation, please review it before use the new version.


If you dont have internet access from your MT you can use the offline update provided here as well. Remember to unzip the file first.


Note for the first time we introduced support for ikev1 IPSEC L2L within Cisco ASA configurations. Please take this in consideration when use it and please report anything you consider is wrong or can be enhanced, let's use the power of this community to improve the tool.



New Features
[MT-157] - Added Multi Edit on Nat Rules
[MT-174] - Add support for Regions under Objects
[MT-220] - Add CISCO VPN L2L support (First version)
[MT-223] - Zones. Remove or Set Interfaces in the zones by selecting them
[MT-275] - Rename IPSecTunnel, IKE Gateway and Zones with a single click
[MT-276] - Attach IKE V1 and IKE V2 Profiles to the selected IKE Gateways
[MT-167] - Created new Tab for VPN. Added support for IPSec Tunnels, GlobalProtect and NetworkProfiles


[MT-181] - Reduced by 52x the time to import a Palo Alto Networks configuration.
[MT-216] - Added the option to Enable/Disable Rule Filters
[MT-219] - NAT. SRX and Screenos. Support for Rules where a SNAT and DNAT its applied.
[MT-252] - SNIPPETS. Added support for Applications-Groups, Address, Services and Wildfire Profiles. Multiple entries are supported inside some snippets. Check Documentation.
[MT-253] - Virtual Router Editor. Added a Checkbox to add all the Interfaces with a single click
[MT-269] - Consolidation. Added the field Action
[MT-270] - Policy Filters: Clear button clear all Filters if any is selected and closes the view automatically


Have fun !!


Updated with a change in the OUTPUT Api Manager behavior, now all is EDIT instead of SET when SubAtomic is selected.


What is this bundle?  The uncompressed file has no indication of what this is (no file exention on the resultant file)

Previous distributinon had VM files for import.

Encountering the same issue as Frank_Henry. Downloaded the .zip and all I see is a .bundle file. There are no VMWare files as indicated in the user guide. Going back to 3.2 for now.

Has anybody figured out how to install this version?  All I see after I expand the zip file is a .bundle file.

@WCoats, I did figure out how to install this version. They don't make it that readily apparent in the installation instructions, but what you have to do is install the base version of the Migration tool *first* to create the virtual machine. The file that is attached to this article is just a patch file that will upgrade you to version 3.3.

To download the VM, go here: https://live.paloaltonetworks.com/t5/Migration-Tool-Articles/Download-the-Migration-Tool/ta-p/56582


Once you have the VM downloaded and installed in VMWare workstation, ESXi, or whatever hypervisor you're using; log into the web-based GUI. There is an option in the main dashboard to upgrade the version of the tool. Upload the .bundle file in the "browse" window and it should upgrade the software. I went from 3.1, to 3.2, to 3.3 personally, so IDK for sure if you can go from 3.1 directly to 3.3.


Hope this helps!

Tipically to get latest update you have to click from the main view after login on the Updates tab and click the Update button. In the case your MT can't reach internet then you can use the bundle files. But only on this case, use always the Update button if you dont any restriction to go to Internet.

Got it working. Thanks for the information above.



I am unable to see the "actions" in the Manage Policies section.   I have right clicked and selcted to"actions" from the column headings.



I have tried in both Chrome and FireFox as well as selectinvg the "all, shared and vsys1" options in the upper right.


Is there a workaround?

regards and thanks,


Don B



The migration tools dont work with Sonicwall? why?


We have a lot of customers with Sonicwall and we are recommended as a substitute "Palo Alto Networks".


I hope that, in the future or in next version, may be possible convert Sonicwall config to Palo Alto with Migration Tool.


Best regards,


Frederico Pereira

ACE - Palo Alto Networks

Has the Update server been decommisioned? For three weeks I tried to update my 3.1 and no luck. Finally I saw this post and updated to 3.3.9 with the bundle. Now I hit the green "Update" button and I still get nothing. I saw one resident engineer had 3.3.14 on his MT. My dns settings are fime. My MT server can ping www.yahoo.com and can resolve conversionupdates.paloaltonetworks.com but I get no response from Ping.



Maybe I'm blind but I don't see the link to download the offline update for 3.3 in this document. So posting it here.




We had problems with the conversion from Cisco ASA to PA too.

There was a directory missing on the migration appliance. To fix this you have to get root (single user mode, or boot from a rescue cd) and create the directory:


[root@PanMigrationTool ~]# cd /var/www/html
[root@PanMigrationTool html]# mkdir Templates
[root@PanMigrationTool html]# chown apache:apache Templates



There is a second issue with the interface and vrouter config, which gets created. We created the interface config manually in panorama and then pushed the remaining part via single xml requests.

Hello eveyone.

I'm trying to confirm if I could use MT3.3 to migrate firewalls into a PA-5220, PAN-OS 8.0.7. I understand that I will need a device with those characteristics but MT3.3 only have 5000 and 7000 series. Is it 5220 included in 5000 or has to be 5200 series as expected?



We are migrating our Firewall with the MT to Panorama, behind Panorama there are multiple PA-5220 and PA-3020 running PAN-OS 8.0.x.

I think it should work, but you may have problems regarding the interface and vsys configuration.

We are creating interfaces and vsys,vrouter manually and pushing the config only for our needed parts. It was a little bit try and error, but now it works.

Ask Questions Get Answers Join the Live Community
Version history
Revision #:
6 of 6
Last update:
‎04-22-2016 08:35 AM
Updated by: