ASA migration to PA

[Bkrishnamoorthy]

Hi Team,

We want to migrate our firewalls from cisco ASA to Palo Alto. Instead of performing hot cutover, we are thinking the other option by connecting them inline to existing firewalls so that it will just monitor all policy and etc, which will help us to fix any of the configurations so that we can remove the existing firewalls without any major issue. Please suggest a way to deploy or share if there is any documentation relate to it.

[Raido_Rattameister]

If you want to put Palos inline then it's interfaces need to be in virtual-wire mode for that period.

It allows to capture traffic and reverse engineer what policies need to be configured but it is way easier to migrate like-to-like to be sure everything is working after migration and then tune policies as needed.

[OtakarKlier]

Hello,

If the PAN's are running newer code, etc, they will learn and suggest applications to the policies as you input them.

Regards,

[Bkrishnamoorthy]

Yes @Raido_Rattameister  Intially i thought the same of doing like-to-like migration, but we won't have any user for UAT during maintenance window, only they will be available in the next morning. Since we have some hundred of policies, if many are impacted it would be a nightmare. In order avoid that i looking for virrual wire option, is there migration document available?

[Bkrishnamoorthy]

Hi @OtakarKlier It's a PA 5420 model and so we would run a latest code. 

[OtakarKlier]

Hello,

I also want to point out that there is the 'Expedition' tool for migrating configurations from another platform to Palo Alto. I have not used it before, however others have stated that it worked fairly well. Also I would suggesting on leaning on your sales engineer to help out, etc.

https://live.paloaltonetworks.com/t5/expedition/ct-p/migration_tool

Regards,

[Raido_Rattameister]

Expedition is very nice tool but depending of ASA config it needs manual review and not everything is migrated over.

Unless customer is ok to fix any upcoming issues morning after migration I would definitely expect customer side UAT testing right after failover.

[Bkrishnamoorthy]

Is there any sample configuration to set it up for inline , so that i can review the polices and fix them.

[OtakarKlier]

Hello,

So the inline method, you will want to do the following:

1. Create a virtual wire, vwire, ie port 1 and 2
   1. 1 will be from the PAN to the ASA and 2 will be from the PAN to the internal switch
2. Create a Allow ALL policy between the two zones
   1. Then make sure to keep that Allow ALL policy at the bottom, eg last policy
   2. Create any policies for the traffic that are specific above the policy so that it will get hit first.

Hope that makes sense.

[Bkrishnamoorthy]

@OtakarKlier  Thanks for your input.