The conversion brain behind every modern firewall migration.
Palo Alto retired Expedition. Fortinet's Migration Tool was never the answer. NetConverter is the platform that translates the config, validates behavioral equivalence, and certifies the cutover — so your team can ship.
Every decision carries provenance. Every migration is behavior-validated. Every optimization is evidence-backed. AI explains — deterministic systems decide.
What it does
Engine = Truth
Deterministic IR pipeline maps every object, rule, NAT, and zone across 35 firewall, router, and switch paths — the translation moat.
Governance = Trust
Four checkpoints plus BC1–BC4, provenance lineage, and governed evidence. Deterministic decides; AI explains.
Surface = Experience
Migration estimator, 19-section evidence report, and operational intelligence layer across conversion, validation, and optimization.
Why now
Expedition is end-of-life. The FortiGate Migration Tool stops at line conversion and never validates that the new config actually behaves like the old one. Skybox and Tufin price for analytics, not migrations. NetConverter was built specifically for the cutover problem: deterministic translation, behavioral equivalence, evidence sufficient to defend a change ticket. Not a line-converter, not an LLM wrapper — a deterministic engine with a provenance/trust layer.
- → KB-first pipeline — 80 percent of decisions resolve without AI cost.
- → Behavioral checks BC1–BC4 — ACL, NAT, shadowing, zone integrity.
- → Vendor rulepacks block PAN-OS, FMC, FortiOS invariants pre-push.
- → Evidence report sufficient for change advisory boards.
- → No seat licenses — pay per translation, no ceiling.
Proof
Cisco
ASA · FTD · FMC · IOS-XE
Palo Alto
PAN-OS · Panorama · SCM
Fortinet
FortiGate · FortiManager
Juniper
JunOS routers + switches
Aruba
CX switches · ArubaOS
Production translations validated against live Panorama 11.2 and FMC 7.6 sandboxes. Sample evidence reports in the docs.
- → Every decision carries provenance
- → Behavior-validated BC1–BC4
- → Regression-gated release pipeline
- → Governed 19-section evidence report
How it works
Upload Surface
Upload or paste a source configuration. Vendor auto-detected.
Parse + extract Engine
Source config to vendor-agnostic IR. CP0 confirms full extraction coverage.
Translate + validate Governance
Serialize to the target vendor. CP1–CP4 plus BC1–BC4 confirm equivalence.
Ship Surface
Download validated config plus 19-section evidence report. Push to Panorama or FMC.