Professional support · Terraform migration
Home · Professional support · Terraform to public cloud
Terraform automation for Palo Alto, FortiGate and Zscaler to the public cloud
We use Terraform to land on-premises Palo Alto, FortiGate and Zscaler intent in Azure, AWS, Google Cloud or OCI. The price is not printed because it depends on the estate. Message WhatsApp and we quote it. Terraform does not convert every object one-for-one.
What the automation actually is
Terraform is the delivery tool. The work is still a migration: know the source, name the target, review the plan, apply when the window is open. We do not sell a script that promises a converted firewall overnight.
| Source | Provider we use | Honest limit |
|---|---|---|
| Palo Alto PAN-OS or Panorama | PaloAltoNetworks/panos | Security policy, objects, NAT and interfaces have resources. Device-specific and one-off GUI state may not. Panorama device-group scope is agreed before any apply. |
| FortiGate or FortiManager | fortinetdev/fortios | The provider covers FortiOS and FortiManager resources. A VDOM layout and central SNAT policy are mapped, not assumed identical in the cloud VM. |
| Zscaler ZIA and ZPA | zscaler/zia and zscaler/zpa | Zscaler is already a cloud. “Move to public cloud” here means policy-as-code plus the cloud network and identity path, not copying a box into a VPC. |
| Azure, AWS, Google Cloud, OCI | The public cloud providers | VNet, VPC, VCN, subnets, route tables and the landing firewall or load balancer. The cloud account is yours. |
What you receive
- A discovery export from the firewall or Zscaler tenant, read by a person
- A written map: source object, target resource, or “no equivalent”
- Terraform modules for the cloud network and for the vendor provider that fits
- A terraform plan you review. Apply is a separate yes, inside the window.
- Credentials and state remain in your account
If the job is the cutover itself and Terraform is optional, start on the firewall to Azure, AWS, GCP and OCI page. You can buy both. The written confirmation lists the mix before payment.
Price on discussion
There is no fixed fee. We quote after we see the Palo Alto, FortiGate or Zscaler estate, the target cloud, and the window.
Confirm that quote on WhatsApp before paying. GST extra as applicable. Cloud, firewall and Zscaler licences are not included. Employment is not guaranteed.
Questions people ask before they message
Can Terraform migrate Palo Alto, FortiGate and Zscaler to Azure, AWS, GCP or OCI?
It can express the target. We use the public providers: PaloAltoNetworks/panos, fortinetdev/fortios, zscaler/zia, zscaler/zpa, plus the Azure, AWS, Google Cloud and OCI providers. A provider existing is not the same as every on-premises object having a resource. The price is discussed on WhatsApp after we see the export.
Why is there no price on this page?
A 40-rule branch firewall and a Panorama estate with multiple device groups are not the same job. Zscaler ZIA and ZPA are policy in a cloud, not a VM you lift into a VPC. We quote after the discovery, on WhatsApp, and you confirm before paying. GST extra.
Do you apply Terraform in production on the first call?
No. You get a written object map, modules, and a terraform plan. Apply runs only in the change window you agree. State and credentials stay in your account. We do not keep a copy of firewall API keys after the window.
Will every security rule, NAT rule and Zscaler URL category convert?
No. Address objects, services, NAT and VPN often need a human map. Some objects stay in the GUI or in a second tool. Zscaler publishes import aids for parts of ZIA. We still read the plan. Anything without an honest resource is listed as a gap, not forced into a fake resource.
Related on this desk
Start on WhatsApp
WhatsApp the vendors you run, the target cloud, and whether you want policy-as-code, the cloud network, or both. The price comes back in that chat.
Techclick Infosec Pvt Ltd
CIN U78100UP2025PTC217519
Email: support@techclick.in · WhatsApp: +91 92772 29456