gateshift: the firewall migration tool
Built to make firewall migration and optimization projects easier, faster and safer.
Gateshift reads a firewall configuration, translates it into a vendor-neutral form, enriches it with what the target platform can do, and pushes it through the target's API.
What it can do
- Migrate firewall configurations between different vendors and deployment models: standalones, clusters, unmanaged and managed devices, on hardware, virtual and cloud alike.
- Carry security rules, NAT, address and service objects, interfaces, static routes, IPsec VPN, schedules and tags across to the target.
- Attach what the target itself offers instead of copying the source: security profiles, applications and log settings.
- Generate new rulesets from traffic logs.
- Optimize and clean up firewall configurations, directly on a firewall or during migrations.
- Operate fully offline: no telemetry, no phone-home, no licence callbacks, no cloud uploads, no LLM calls.
Migrating to and from central managers (Panorama, FortiManager, Check Point MDS) is part of the Enterprise Edition. The editions page has the details.
What it can't do
- Do 1:1 migrations.
- Run automated or unattended migrations.
- Guarantee flawless output.
- Make manual review obsolete.
Workflow
Every step is explicit and under the operator's control:
- Add devices via API, configuration file, or traffic logs.
- Select a source and a target.
- Re-map and rename interfaces, physical to virtual and vice versa.
- Filter and consolidate the rules.
- Drop unused and duplicate objects.
- Auto-derive zones and interfaces, auto-assign applications.
- Attach security profiles, log settings and schedules to the rules.
- Push the whole configuration or just selected scopes.
Sources come from an API connection, a configuration-file upload, or traffic logs. Migrations run intra-vendor and cross-vendor, appliance to manager and manager to appliance. With the same device as source and target, the identical pipeline performs in-place optimization and cleanup. Traffic logs can be turned into rule candidates instead of importing a policy.
Supported vendors
| Vendor | Read from | Push to |
|---|---|---|
| Palo Alto Networks (PAN-OS) | yes | yes |
| FortiGate (FortiOS) | yes | yes |
| Check Point (Management API and Gaia) | yes | yes |
| Cisco FTD (FDM-managed) | yes | no |
| Cisco ASA (configuration file) | yes | no |
| OPNsense (traffic logs) | yes | no |
See it in action
Complete migrations, start to finish, on YouTube. These are plain links: nothing is loaded from YouTube on this page.
- Check Point to Palo Alto Networks (Panorama): Part 1, import and enrichment
- Check Point to Palo Alto Networks (Panorama): Part 2, push and verification
- Palo Alto Networks to FortiGate (single firewalls)
- FortiGate to Check Point (single firewalls)
Intended use
Gateshift is a tool for specialists. It assumes you know the platforms involved and can judge a firewall configuration on its merits; it is not a substitute for that judgment.
Verification is the operator's job
Gateshift can and will get things wrong. What it pushes onto a target is a draft, not a finished configuration: review it there, test it, and decide for yourself whether it goes live. Everything the tool does on a device happens on the operator's authority and remains the operator's responsibility.
Configuration backups and verification are the operator's responsibility and a mandatory part of every migration:
- Back up every system before Gateshift touches it.
- Read Gateshift's own log.
- Review the pushed configuration on the target.
- Test the result for correctness and function before cutover.
What Gateshift does not do is written down: read KNOWN_LIMITATIONS.md in the repository
before the first migration. Most reported "tool bugs" turn out to be device access problems: an API
user missing a trusthost, an unpublished Check Point API user, or a PAN-OS password pasted into the
API-key field.
Warranty and liability are set out on the legal page.
Transparency
Gateshift started as a hand-written project; its development is now AI-assisted. The product itself contains no AI. The source can be read, and every release is guaranteed to become genuine open source (MPL 2.0) four years after it ships (see the legal page). A CycloneDX SBOM in the repository lists every dependency and its licence.
Where it is going
Direction, not commitment. These entries carry no dates:
- 1.0: stability round incorporating first feedback.
- Vendor cloud managers: Strata Cloud Manager, Smart-1 Cloud, FortiManager Cloud.
- Additional vendor and device support.
- Configuration snapshots: save working states and revert to them.
- Multi-tenancy.
Status
Version 0.9.2 is feature-complete and verified against live appliances across the full cross-vendor matrix. Gateshift remains an independent project in active development.