Expedition Supported 3rd Party Vendor Matrix

[lychiang]

Expedition supports migration sections of the below Vendor's configuration to PAN-OS configuration

**The list of tested Vendor OS version, version not listed here needs further validations

*** The UserID CN chain is extracted from the original configuration and integrated into the migrated security rule. However, the device configuration must be manually performed on the device itself.

Table1: Expedition supports converting 3rd Party vendors config sections (Updated on 2024/01/01)

Note: Table will be updated when new support added

Vendor

Supported Vendor OS**

Global Address Object

Address Objects

Address Group Objects

Service Objects

Service Group Objects

User ID

Security Policy

NAT Policy

Network Interface (L3 only)

Routing(Static Routes Only)

VPN

Checkpoint

R75,R77

✔

✔

✔

✔

✔

✔  ***

✔

✔

✔

✔

> R80

✔

✔

✔

✔

✔

✔  ***

✔

✔

✔

✔

Cisco

ASA 9.0, 9.1,9.6,8.2,8.4,

✔

✔

✔

✔

✔

✔

✔

✔

✔

✔

FirePower [only in ASA syntax]

✔

✔

✔

✔

✔

✔

✔

✔

✔

Fortinet

Fortigate 4.0, 5.0,6.0

✔

✔

✔

✔

✔

✔

✔

✔

✔

IBM XGS

5.1

✔

✔

✔

✔

✔

✔

✔

✔

Juniper

All Netscreen Firewalls (ScreenOS)

✔

✔

✔

✔

✔

✔

✔

✔

✔

Junos 11.4, 12.1, 12.3

✔

✔

✔

✔

✔

✔

✔

✔

✔

Forcepoint

Sidewinder

✔

✔

✔

✔

✔

✔

✔

Stonesoft

✔

✔

✔

✔

✔

✔

✔

✔

[AnthonyTanzi]

When will Expedition 2.x be available? 

[AnthonyTanzi]

Is that April of 2022?

[lychiang]

Yes

[Sanfran_Ryan]

Hi,

In my memories, there are some migration guide for these 3rd party devices, but I can't find it now.

Is there anyone have the link?
What I had downloaded before is "Forcepoint Sidewinder Migration Guide.pdf"

Thanks.

[Thrauma]

Hello

What About Stormshield ? Is there a way to use Expedition OR to use another tool/method to convert for SShield to PA ?

[msasadaira]

For Stormshield you can export the rules and objects in CSV and then use Expedtion to import these CSVs and build your configuration.

[mkukucska]

Hi,

How about Sonicwall firewalls? Is there chance to use Expedition tool to convert Sonicwall config?

Thanks,

Misi

[lychiang]

Hi @mkukucska Yes, it is in the roadmap of Expedition 2.x 

[mkukucska]

And when can we expect Expedition 2.x to be released?

[ghughes]

Hello!

Any plans on including Watchguard Firebox in the Expedition tool?

Thanks!

[dpuigdomenec]

Hi @ghughes 

Sorry but we do not have plans to add more supported 3rd party vendors to our list of parsers.

In case you need to execute a migration from a non-supported vendor (or even supported one at a big scale) I will encourage you to contact to your sales account contact for PS Migration Factory engagement. 
Hope this helps,

Best,

David

[iccnetmgr]

Can the Expedition tool offer a shortcut to importing a PA-850 PAN-OS v8.1 to a PA-3410 PAN-OS v10.1?
Kind Regards,
Dan

[dpuigdomenec]

Hi @iccnetmgr 

Expedition tool is intended to help on migrations from 3rd party vendors and also to optimise the security posture on a PANOS device.

The migration you are describing could be done using PANOS features as export and import from old to new devices (you may need to update networking information and VPN configuration). 

Once you have your configuration pushed to your new device you can download it to Expedition and do some optimisation like removing duplicates and merging similar policies among other features Expedition can help.

For assistance on the PANOS upgrade I will suggest you contact the TAC team so they can provide you more information and guides.

Hope this helps,

David

[s.Govardhanam]

Is this tool is support to migrate from Sophos firewall to PA 440 ?

[dpuigdomenec]

Hi @s.Govardhanam 

Thanks for reaching out but unfortunately Expedition does not support Sophos.

Given your scenario:

• I encourage you to contact your sales account representative to point you to the PS/Migration Factory team or
• Alternatively you can explore using the import from CSV functionality available in Expedition1, you will need to export into a file (CSV) the unsupported 3rd party vendor configuration. Reference documentation here: https://live.paloaltonetworks.com/t5/expedition-articles/a-how-to-guide-on-the-import-csv-option/ta-...

Hope this helps,

[darrenchew]

Hi @lychiang, saw your comment wrt to the roadmap of conversion from Sonicwall to PAN OS. Is the conversion available today on Expedition 2.0? Thank you. 

[lychiang]

Hi @darrenchew Expedition 2.x will need panser for sonicwall migration, please see detail https://pan.dev/expedition/docs/expedition_export/#sonicwall I will encourage you to contact migration factory team for more details. 

[darrenchew]

Hi @lychiang Thank you very much for the sharing.