Migrating Cisco multi-contexts into one vsys Palo Alto firewall

[AK74]

Hi there,

We are looking to migrate a Cisco ASA 5545 with two contexts (Internet and LAN) to a PA-1420. We don't have a multi-vsys license, so everything needs to be merged into a single vsys. We’ll be managing the PA locally (no Panorama) and using the Expedition tool for the migration.

Is it possible to merge both ASA contexts into one vsys? If so, what is the best way to achieve this? I know we can use two Virtual Routers (VRs) to keep the routing tables separate, but I'm unsure about the best approach for merging the security policies, objects, and services.

Thanks

[TomYoung · Accepted solution]

Hi @AK74 ,

Is it possible to merge both ASA contexts into one vsys?  Yes.  In my opinion, separate vsys are for separate administration and separate VRs are for segmentation.

If so, what is the best way to achieve this?  Using 2 VRs is the way.  You don't need separate security policies.  Each VR should have unique zones which ensure the security policy rules only apply to one VR at a time.  You can divide your security policy into 2 sections, one for each VR.  You could even use tags to group your security policy so that you can manage them separately.  Because of the different zones, it is effectively 2 security policies.

I wouldn't worry about the NGFW having the same objects and services to be used by both VRs,  The policies and zones determine which is used for each VR.

Thanks,

Tom

[AK74]

Thank you so much, Tom

I'll test it and let you know