Is there tool available to sync the config from physical Paloalto on-premise the disaster recovery site in Azure?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Is there tool available to sync the config from physical Paloalto on-premise the disaster recovery site in Azure?

L1 Bithead

We have onpremise network and paloalto firewalls and zone base zero trust config and we want to have the DR in Azure on virtual firewalls and looking for the way to convert and sync the config from on-premise physical firewalls to Azure virtual firewalls. I know there are some magic need to be done to convert vlans to subnets/vnets and update all firewall policies, etc...


Is it feasible and if yes is there any available tool/utility that we can use to sync the firewall config in a daily basis? or automate it?





Community Team Member

Hi @farshadhadei ,


I don't know if there is a tool that will automatically do that for you, but what you can do is use the Expedition migration tool and convert the network settings and policies to your liking. 

LIVEcommunity team member
Stay Secure,
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Cyber Elite
Cyber Elite


Best bet since you want this to happen regularly is to automate it by migrating your configuration efforts to modifying the XML directly (or having it done via a scripted pull of the config) and using Jinja2 to handle the templating where necessary (like replacing everything in <deviceconfig>). 


An example of a what this would look like from a config standpoint would be like so:

        {% include [deviceconfig] %}

Then when you render the configuration file to be uploaded and loaded onto the device what you would do is simply include that device's specific configuration with that deviceconfig variable. Mirroring that basic concept for anything that you wish to template within the configuration file, such as targeted IPs, specific interfaces, certain rulebase aspects and so forth. 

thanks for the solution @BPry . I'm planning to test it in our lab environment next week and will let you know the result 

Thanks @JayGolf , I think it's good solution for the migration or short them, I'm not sure if we can automate the expedition tool runs based on template or something, I will do more research to see if the tool supports it

  • 4 replies
  • 38 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!