Migrate from Virtual Wire Mode

[jharlow]

I am currently using the PA-500 in virtual wire mode, including monitoring, AV, Malware, etc. and web filtering. I want to start transitioning to layer 3 in order to move off of our Cisco ASA (currently sits on the inside of the PA500).  What is the best way to start this process without lossing my current setup and with minimum downtime?

Outside > PA500 (Currently monitoring,AV,Malware,Web Filter) > Cisco ASA (NAT translation/VPN)

Thanks!

[OtakarKlier]

Hello,

The way I have done this in the past is to create security policies that best match the ASA. At the bottom of the rules, have an any/any/any rule. Kepp tweaking your rules and adding new ones until you see the traffic hitting the 'Any' rule to an acceptable amount. Then remove the 'ANY' rule and watch the logs and keep tweaking the rules as needed. Once you are happy you are not blocking any legit traffic, remove the ASA.

I know it was a very high oerview, but I hope this helps. Also I'm sure your SE 'may' be able to help out and guide you.

Cheers!

[pulukas]

If you have enough interfaces (or can use q-tags), you could configure the layer 3 replacement for the ASA in parrallel with your existing v-wire.  Then the PA will start by mirroring your existing setup.  Then you can slowly convert your rules to more application specific with inspections as you monitor the traffic.

You should also check out the migration tool to see how this can help you get a first pass at the conversion of your rules from ASA to PA.

https://live.paloaltonetworks.com/t5/Migration-Tool/ct-p/migration_tool