Is there tool available to sync the config from physical Paloalto on-premise the disaster recovery site in Azure?

[farshadhadei]

We have onpremise network and paloalto firewalls and zone base zero trust config and we want to have the DR in Azure on virtual firewalls and looking for the way to convert and sync the config from on-premise physical firewalls to Azure virtual firewalls. I know there are some magic need to be done to convert vlans to subnets/vnets and update all firewall policies, etc...

Is it feasible and if yes is there any available tool/utility that we can use to sync the firewall config in a daily basis? or automate it?

Best,

[JayGolf]

Hi @farshadhadei ,

I don't know if there is a tool that will automatically do that for you, but what you can do is use the Expedition migration tool and convert the network settings and policies to your liking. 

[BPry]

@farshadhadei,

Best bet since you want this to happen regularly is to automate it by migrating your configuration efforts to modifying the XML directly (or having it done via a scripted pull of the config) and using Jinja2 to handle the templating where necessary (like replacing everything in <deviceconfig>). 

An example of a what this would look like from a config standpoint would be like so:

      <deviceconfig>
        {% include [deviceconfig] %}
      </deviceconfig>

Then when you render the configuration file to be uploaded and loaded onto the device what you would do is simply include that device's specific configuration with that deviceconfig variable. Mirroring that basic concept for anything that you wish to template within the configuration file, such as targeted IPs, specific interfaces, certain rulebase aspects and so forth. 

[farshadhadei]

thanks for the solution @BPry . I'm planning to test it in our lab environment next week and will let you know the result 

[farshadhadei]

Thanks @JayGolf , I think it's good solution for the migration or short them, I'm not sure if we can automate the expedition tool runs based on template or something, I will do more research to see if the tool supports it