The conversion brain behind every modern firewall migration.
Palo Alto retired Expedition. Fortinet's Migration Tool was never the answer. NetConverter is the platform that translates the config, validates behavioral equivalence, and certifies the cutover — so your team can ship.
What it does
Translate the config
Vendor-agnostic IR pipeline maps every object, rule, NAT, and zone across 35 firewall, router, and switch paths.
Validate the equivalence
Four checkpoints plus four behavioral checks confirm the target permits the same flows the source did.
Certify the cutover
Nineteen-section evidence report for change advisory boards, with cost, decisions, and per-rule mapping.
Why now
Expedition is end-of-life. The FortiGate Migration Tool stops at line conversion and never validates that the new config actually behaves like the old one. Skybox and Tufin price for analytics, not migrations. NetConverter was built specifically for the cutover problem: deterministic translation, behavioral equivalence, evidence sufficient to defend a change ticket.
- → KB-first pipeline — 80 percent of decisions resolve without AI cost.
- → Behavioral checks BC1–BC4 — ACL, NAT, shadowing, zone integrity.
- → Vendor rulepacks block PAN-OS, FMC, FortiOS invariants pre-push.
- → Evidence report sufficient for change advisory boards.
- → No seat licenses — pay per translation, no ceiling.
Proof
Cisco
ASA · FTD · FMC · IOS-XE
Palo Alto
PAN-OS · Panorama · SCM
Fortinet
FortiGate · FortiManager
Juniper
JunOS routers + switches
Aruba
CX switches · ArubaOS
Production translations validated against live Panorama 11.2 and FMC 7.6 sandboxes. Sample evidence reports in the docs.
How it works
Upload
Upload or paste a source configuration. Vendor auto-detected.
Parse + extract
Source config to vendor-agnostic IR. CP0 confirms full extraction coverage.
Translate + validate
Serialize to the target vendor. CP1–CP4 plus BC1–BC4 confirm equivalence.
Ship
Download validated config plus 19-section evidence report. Push to Panorama or FMC.