Cisco ASA Config to Palo Alto

[Momoj]

Hi all,

Just want to have discussion on the Cisco ASA config to Palo Alto Config. 

There is a NAT issue when we migrate the configuration. For Many to One, Palo Alto can detect Many to One NAT. When we do the migration, we detect the Many to One NAT should have bi-directional NAT on the ASDM GUI. Is it expected like this that, Palo Alto cannot detect the bi-directional NAT for Many to One NAT.

Thank you

[JSmith]

Please note that Expedition performs migration strictly based on the Cisco ASA CLI configuration provided. Due to fundamental architectural differences between Cisco ASA and Palo Alto Networks NGFW, most configurations are not migrated in a strict one-to-one manner, and certain policies or NAT rules may require manual adjustment after migration.

Specifically regarding NAT behavior:

• One-to-One NAT migrated from Cisco ASA is shown in Expedition as a one-directional NAT. If bidirectional behavior is required, the Bi-Directional option can be enabled directly on the Palo Alto firewall.

• Many-to-One NAT does not support bi-directional NAT behavior on Palo Alto Networks firewalls. This behavior is by design and aligns with Palo Alto NAT implementation. In such cases, the configuration must be restructured accordingly, as documented in the KB below:
  https://docs.paloaltonetworks.com/ngfw/networking/nat/destination-nat-exampleone-to-many-mapping

This is not a limitation of Expedition. The tool reflects exactly what is detected from the Cisco ASA CLI configuration. Any discrepancies observed between Cisco CLI output and Cisco ASDM must be validated on the Cisco side.

It is also expected behavior that certain configuration elements require manual intervention post-migration. This has been reported by multiple users and is documented in the Expedition community KB below:
https://live.paloaltonetworks.com/t5/expedition-discussions/migrating-asa-to-palo-alto/td-p/1235604

Based on our review, the NAT configuration falls under these scenarios where manual configuration on the Palo Alto firewall is required, rather than being an Expedition migration issue.