This page is a synthetic walkthrough. It is not a customer engagement. Addresses are documentation ranges only (RFC 5737: 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24). Object names are fake (net-inside, svc-web).

Synthetic case study: ASA → PAN-OS (checkpoint-validated)

A mid-size ASA export converted to PAN-OS through configuration and behavior checks. Status words are real; the estate is not. There is no population accuracy score.

Quick Convert sign-in Engage

Required input

Convert starts from an ASA show running-config export. It is not a live SSH session and does not collect device credentials on the cloud convert path. SaaS uploads that file to netconverter.ai (CloudFront → ALB → app). Configs leave the customer network on SaaS. AI receives summaries and counts, not the raw config. See encryption and the ASA → Palo Alto technical reference.

This synthetic estate is sized like a mid-size pair: inside/dmz/outside nameif zones, object NAT on a published host, mixed TCP/UDP service groups, and one interface whose zone mapping is left unresolved to illustrate a blocking zone-integrity finding.

Semantic gaps

Security levels → zones

ASA interface security-levels have no 1:1 PAN-OS equivalent. The synthetic export uses nameif inside/dmz/outside. One extra interface is left without a zone so zone integrity returns BLOCKED rather than guessing.

Object NAT split

ASA object network host-web with embedded NAT must split into a PAN-OS address object plus a NAT policy. The synthetic uses 198.51.100.10 inside and 203.0.113.10 published.

Mixed services

A service group containing TCP and UDP is split into single-protocol PAN-OS services. That transform is deterministic and still appears as NEEDS_REVIEW so an engineer confirms references.

Example pipeline outcomes

No production job IDs. Outcomes use the real status vocabulary only.

BLOCKEDOne blocking zone-integrity finding: an interface has no resolvable target zone. The reviewer must resolve the missing context.

NEEDS_REVIEWSeveral items: mixed TCP/UDP service split; App-ID vs service-port policy choice left unset; unused objects listed but not deleted (unused-object delete is not productized).

PASSED_WITH_WARNINGSRemainder of objects, object-NAT split, and access-lists that mapped cleanly to zone-based rules after de-duplication.

PASSEDNot claimed for the whole job. A blocking zone-integrity finding keeps the translation out of PASSED until the zone map is fixed.

Evidence outline (redacted-style)

Public vocabulary only. Review these named findings — not a fake accuracy percentage.

Objects and references: review source/target dependencies and the missing zone.
Policy and NAT: compare the intended source behavior with the target findings.
Decision: retain the blocked status until the unresolved zone is addressed; advisory explanations do not approve deployment.

Full checkpoint contract: validation framework.

Synthetic SET excerpt

Synthetic example, not a customer. Documentation IPs only.

set address net-inside ip-netmask 192.0.2.0/24
set address host-web ip-netmask 198.51.100.10/32
set address host-web-pub ip-netmask 203.0.113.10/32
set service svc-web protocol tcp port 443
set rulebase security rules allow-web from untrust
set rulebase security rules allow-web to dmz
set rulebase security rules allow-web source any
set rulebase security rules allow-web destination host-web
set rulebase security rules allow-web service svc-web
set rulebase security rules allow-web action allow
set rulebase nat rules web-dnat from untrust
set rulebase nat rules web-dnat to dmz
set rulebase nat rules web-dnat destination host-web-pub
set rulebase nat rules web-dnat destination-translation translated-address host-web

Run this path yourself

Upload an ASA export in Quick Convert, or talk to us about a real estate. Engineer review of BLOCKED and NEEDS_REVIEW items is required before cutover.

Quick Convert sign-in Engage

ASA → Palo Alto guide · Validation framework · Migration hub