This page is a synthetic walkthrough. It is not a customer engagement. Addresses are documentation ranges only (RFC 5737: 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24). Object names are fake (net-inside, svc-web).

Synthetic case study: ASA → PAN-OS (checkpoint-validated)

A mid-size ASA export converted to PAN-OS through named checkpoints (CP1–CP4) and behavioral checks (BC1–BC4). Status words are real; the estate is not. There is no population accuracy score.

Quick Convert sign-in Engage

Required input

Convert starts from an ASA show running-config export. It is not a live SSH session and does not collect device credentials on the cloud convert path. SaaS uploads that file to netconverter.ai (CloudFront → ALB → app). Configs leave the customer network on SaaS. AI receives summaries and counts, not the raw config. See encryption and the ASA → Palo Alto technical reference.

This synthetic estate is sized like a mid-size pair: inside/dmz/outside nameif zones, object NAT on a published host, mixed TCP/UDP service groups, and one interface whose zone mapping is left unresolved so BC4 can fire.

Semantic gaps

Security levels → zones

ASA interface security-levels have no 1:1 PAN-OS equivalent. The synthetic export uses nameif inside/dmz/outside. One extra interface is left without a zone so BC4 zone integrity returns BLOCKED rather than guessing.

Object NAT split

ASA object network host-web with embedded NAT must split into a PAN-OS address object plus a NAT policy. The synthetic uses 198.51.100.10 inside and 203.0.113.10 published.

Mixed services

A service group containing TCP and UDP is split into single-protocol PAN-OS services. That transform is deterministic and still appears as NEEDS_REVIEW so an engineer confirms references.

Example pipeline outcomes

No production job IDs. Outcomes use the real status vocabulary only.

BLOCKEDOne BC4-class zone integrity finding: an interface with no resolvable target zone. Serialize is not called until the zone map is completed. BC4 is a hard stop.

NEEDS_REVIEWSeveral items: mixed TCP/UDP service split; App-ID vs service-port policy choice left unset; unused objects listed but not deleted (unused-object delete is not productized).

PASSED_WITH_WARNINGSRemainder of objects, object-NAT split, and access-lists that mapped cleanly to zone-based rules after de-duplication.

PASSEDNot claimed for the whole job. A BLOCKED BC4 finding keeps the translation out of PASSED until the zone map is fixed.

Evidence outline (redacted-style)

Public vocabulary only. Review these named findings — not a fake accuracy percentage.

CP1 objects: address and service objects for net-inside, host-web, svc-web present after split.
CP2 features: object-NAT and twice-NAT features mapped; App-ID mode not selected — engineer choice.
CP3 refs: deterministic parse-back of the emitted PAN-OS target; no AI. Dangling zone on the extra interface.
CP4a: 152 rules / 13 packs evaluated against the Palo Alto target.
CP4b: declared AI correction on unknowns only; AI saw summaries/counts, not the raw export.
CP4c: advisory notes only — cannot fail the job.
BC1–BC4: BC2 NAT path on the published host; BC4 BLOCKED on the unzoned interface.

Full checkpoint contract: validation framework.

Synthetic SET excerpt

Synthetic example, not a customer. Documentation IPs only.

set address net-inside ip-netmask 192.0.2.0/24
set address host-web ip-netmask 198.51.100.10/32
set address host-web-pub ip-netmask 203.0.113.10/32
set service svc-web protocol tcp port 443
set rulebase security rules allow-web from untrust
set rulebase security rules allow-web to dmz
set rulebase security rules allow-web source any
set rulebase security rules allow-web destination host-web
set rulebase security rules allow-web service svc-web
set rulebase security rules allow-web action allow
set rulebase nat rules web-dnat from untrust
set rulebase nat rules web-dnat to dmz
set rulebase nat rules web-dnat destination host-web-pub
set rulebase nat rules web-dnat destination-translation translated-address host-web

Run this path yourself

Upload an ASA export in Quick Convert, or talk to us about a real estate. Engineer review of BLOCKED and NEEDS_REVIEW items is required before cutover.

Quick Convert sign-in Engage

ASA → Palo Alto guide · Validation framework · Migration hub