gateshift: the firewall migration tool

Built to make firewall migration and optimization projects easier, faster and safer.

Gateshift reads a firewall configuration, translates it into a vendor-neutral form, enriches it with what the target platform can do, and pushes it through the target's API.

What it can do

Migrating to and from central managers (Panorama, FortiManager, Check Point MDS) is part of the Enterprise Edition. The editions page has the details.

What it can't do

Workflow

Every step is explicit and under the operator's control:

  1. Add devices via API, configuration file, or traffic logs.
  2. Select a source and a target.
  3. Re-map and rename interfaces, physical to virtual and vice versa.
  4. Filter and consolidate the rules.
  5. Drop unused and duplicate objects.
  6. Auto-derive zones and interfaces, auto-assign applications.
  7. Attach security profiles, log settings and schedules to the rules.
  8. Push the whole configuration or just selected scopes.

Sources come from an API connection, a configuration-file upload, or traffic logs. Migrations run intra-vendor and cross-vendor, appliance to manager and manager to appliance. With the same device as source and target, the identical pipeline performs in-place optimization and cleanup. Traffic logs can be turned into rule candidates instead of importing a policy.

Supported vendors

VendorRead fromPush to
Palo Alto Networks (PAN-OS)yesyes
FortiGate (FortiOS)yesyes
Check Point (Management API and Gaia)yesyes
Cisco FTD (FDM-managed)yesno
Cisco ASA (configuration file)yesno
OPNsense (traffic logs)yesno

See it in action

Complete migrations, start to finish, on YouTube. These are plain links: nothing is loaded from YouTube on this page.

Intended use

Gateshift is a tool for specialists. It assumes you know the platforms involved and can judge a firewall configuration on its merits; it is not a substitute for that judgment.

Verification is the operator's job

Gateshift can and will get things wrong. What it pushes onto a target is a draft, not a finished configuration: review it there, test it, and decide for yourself whether it goes live. Everything the tool does on a device happens on the operator's authority and remains the operator's responsibility.

Configuration backups and verification are the operator's responsibility and a mandatory part of every migration:

What Gateshift does not do is written down: read KNOWN_LIMITATIONS.md in the repository before the first migration. Most reported "tool bugs" turn out to be device access problems: an API user missing a trusthost, an unpublished Check Point API user, or a PAN-OS password pasted into the API-key field.

Warranty and liability are set out on the legal page.

Transparency

Gateshift started as a hand-written project; its development is now AI-assisted. The product itself contains no AI. The source can be read, and every release is guaranteed to become genuine open source (MPL 2.0) four years after it ships (see the legal page). A CycloneDX SBOM in the repository lists every dependency and its licence.

Where it is going

Direction, not commitment. These entries carry no dates:

Status

Version 0.9.2 is feature-complete and verified against live appliances across the full cross-vendor matrix. Gateshift remains an independent project in active development.