Architecture and sizing
Placement at fabric border, exchange or branch; HA design; throughput with inspection features enabled, not datasheet numbers.
Security
ASA, FortiGate, Check Point → Palo Alto.
Firewall architecture, policy migration and rule-base hygiene across Palo Alto, Juniper SRX and Fortinet. Policy translated, tested on the twin, cut over with zero rule loss — and left cleaner than we found it.
What's included
01
02
Policy translation
ASA, FortiGate, Check Point or SRX rule bases translated to the target platform with objects normalised and duplicates removed.
03
Rule-base hygiene
Unused, shadowed and overly permissive rules identified from logs; typically 25–40% fewer rules after migration.
04
Twin testing
Translated policy tested against captured production flows before cutover.
05
Cutover
Waves by zone or site, parallel inspection where possible, verification against baselines, rollback ready.
06
Central management
Panorama or Strata Cloud Manager, FortiManager or Security Director configured as the single policy source, driven from code.
How an engagement runs
01
Discovery
Rule bases, logs, flows, dependencies.
02
Translation
Policy converted, cleaned, tested on the twin.
03
Waves
Cutover zone by zone with verification.
04
Operate
Managed firewall operations, optional.
Questions we get asked
Zero rule loss — really?
Every rule in the source is traced to a rule in the target or to a documented removal you approved. The twin test against production flows is how we prove it before the window.
Can you migrate to SRX or FortiGate rather than Palo Alto?
Yes. The method is the same; Palo Alto is simply the most common destination.
Request a quote
Tell us about the project; a senior engineer responds the same business day.