Palo Alto firewall deployment and migration
Best-practice deployment, seamless firewall migration and a validated configuration. We make sure your investment delivers full value from day one.
A correct deployment is half of security
When configured effectively, security solutions stop the vast majority of cyberattacks. But security profiles left at default settings, “any” rules, narrowly scoped SSL decryption or incomplete logging can turn even the most powerful Next-Generation Firewall into a simple port filter. Albisec deploys Palo Alto Networks according to the vendor’s best-practice recommendations and validates the result.
- 1
Discovery and analysis
Review of the current topology, traffic profile, rule base, VPN and identity infrastructure; measurement of throughput and session requirements.
- 2
Design
Zone and segmentation design, HA architecture, SSL decryption scope, security profile groups and the management model (Panorama / Strata Cloud Manager).
- 3
Deployment
Upgrade to the recommended PAN-OS release, licence activation, interface and routing configuration, security profiles and logging.
- 4
Migration
Migration of existing rules, NAT and VPN configuration; clean-up of shadowed and unused rules and the move to App-ID-based policies.
- 5
Cutover
Switch-over in a planned maintenance window with live traffic validation and a rollback plan for a seamless cutover.
- 6
Validation and documentation
Best Practice Assessment, test results, as-built documentation and knowledge transfer to your team.
What deployment and migration include
- PA-Series, VM-Series and CN-Series NGFW deployment; Active/Passive and Active/Active HA
- Central management with Panorama or Strata Cloud Manager, templates and device groups
- GlobalProtect remote access VPN and site-to-site IPsec
- SSL/TLS decryption policy and certificate infrastructure
- User-ID integration (Active Directory, LDAP, SAML/MFA)
- Enabling Advanced Threat Prevention, URL Filtering, WildFire and DNS Security profiles
- SD-WAN, IoT Security and SIEM/syslog integrations
- Migration after a hardware refresh and configuration transfer when products change
After deployment, you can keep your environment protected with our 24/7 support and periodic health check service.
More Palo Alto Networks security services
Frequently asked questions
How long does a Palo Alto firewall deployment take?
Standard single-site deployments are usually completed within a few days. HA clusters, multi-site environments and projects that include migration from another vendor are scheduled during discovery.
Which firewalls can you migrate to Palo Alto?
We migrate from Fortinet, Check Point, Cisco ASA/FTD, Sophos and similar platforms, as well as from older PA models. Rules, objects, NAT and VPN configuration are analysed and adapted to Palo Alto.
Will there be downtime during migration?
Migrations take place in a planned maintenance window with a pre-tested configuration and a rollback plan. With proper planning, downtime is usually a matter of minutes.
Will our team be able to manage the system after deployment?
At the end of the project we provide as-built documentation and hands-on knowledge transfer. If you prefer, we continue managing it together under a support contract.
Talk to our experts about your Palo Alto Networks project
A new deployment, a firewall migration or a support contract: tell us what you need and we will map out the right path with a free initial assessment.