IPSec Conversion utility for Cisco ASA to PAN 6.1.1?

[palomed]

I have a couple of Cisco ASA tunnels I need to convert to Pan. Each has about 200 lines of config all told. Whether I mark things up in a word processor or enter it in PAN gui - it's going to be a slog. Pausing to ask the community: Might there be a conversion utility out there that could help me speed the plow??

[bradk14]

honestly, I'd strongly consider just rebuilding them manually within PA.

nothing automated as far as I'm aware, but I'm sure it's technically possible with the API. Even the migration utility skips VPN migration, in part because by default the pre-shared key is masked when submitting the show run.

[Raido_Rattameister]

Migration tool supports VPN migration from Cisco ASA.

[palomed]

Where do you find such migration tools?

[Raido_Rattameister]

https://live.paloaltonetworks.com/t5/Migration-Tool/ct-p/migration_tool

[bmorris1]

 Whilst you can use the migration tool to copy over the VPNs, I have found that often Cisco ASA devices use poor encryption methods by default and these are not changed. Also they are usually set in a policy-based VPN mode. Depending on how you want to play it, you may be better off starting from scratch and creating proper route-based VPNs on both sides of the tunnel and forgoing the need for long lists of proxy IDs.

In my experience I have found it more trouble than what is is worth when using the migration tool to move over VPNs from ASAs and have always re-created them manually using lovely excel spreadsheets and concatenate forumula to produce the CLI configuration commands for me. Alternatively if you're a decent scripter you could use the API to make it even easier.

hope this helps,

Ben