Watchguard to Palo Alto Migration Options

[Jonathan_C]

Hi,

I was wondering how people have got around migrating from Watchguard to Palo Alto, the migration tool (Expedition) is not an option, or is it? Is there a fairly automated way to do this?

[BatD]

@Jonathan_C
Did you manage to migrate the Watchguard? Can you share your experience? I also javebWarchguard migration task and could not find any advise on how to do it. Shame that no one responded to your post.

[alestevez]

I never migrated any wathguard, even never considered as an enterprise firewall, if you have a config that can be shared with us we can take a look to see how hard will be add it to Expedition. You can send it to fwmigrate at paloaltonetworks dot com

Regards

[BatD]

Hi @alestevez 

Thank you for your response. Watchguard has its market share in UK and some European countries. I had 3 migration requests over the last half a year, although I did it manually or building from scratch, but this current one seems to be more conifg which will need some automation. I will try to get a config to share. 

[Jonathan_C]

@BatD I ended up taking a mixed approach. The security policies on the Watchguard were less than a 100 so I got the table from the web interface and moved it to an Excel spreadsheet. From there worked out the address objects and address groups and put then in PANW format in a different spreadsheet.

Once I had the basic policy looking like a PANW policy, I used Pandevice (https://pandevice.readthedocs.io/en/latest/configtree.html) to write a script and load the policies and objects onto the new firewalls.

The NATs on the other hand, was a completely manual process as I had to match all the possible traffic flows. It was a bit of a process but once I got the first FW correct the other 3 were fairly straight forward.

@alestevez I agree with you, Watchguards are not common on the enterprise but as businesses grow and mature they are moving to an enterprise platform, hence the question. PA-200 wouldn't be considered enterprise for example but they are good enough for remote sites or small business that want to take a step towards modern firewalls. I can get you a configuration file from one of the old boxes.

[alestevez]

@Jonathan_C Please send to me to fwmigrate at paloaltonetworks dot com Thanks!

[Kaliman]

Hello Albert,

is there any secure way to send you the config and see if you can help me to migrate it to PAN?

Thanks

[dgildelaig]

We are sorry, but we do not support Watchguard yet, even it is in the roadmap.

In your case, you may have to contact Professional Services to give you support on it.

[Jonathan_C]

Hi @Kaliman, what I ended up doing with this was to get the objects and policies out of the Watchguard in a spreadsheet, then using pandevice wrote some code to push it programmatically to the PANW.

Once you have that, then fix the security profile groups. I was lucky enough the migration I worked on was on some small firewalls so the policy wasn't crazy complex

hope this helps

[Kaliman]

Thank you Jonathan