Firewall & Proxy Migration — Six Tracks, One Playbook

• The five failure modes: silent NAT, unused “any any”, missing identity, SSL exceptions, no rollback owner
• Inventory first: rules, NAT, VPN, objects, PAC, certs, IdP, hit-count
• Pilot → dual-run → phased cutover → decommission
• Write the one-page Method of Procedure before you type

• Zones vs layers vs security zones vs VSYS / VSX
• Port vs App-ID vs Check Point application vs URL category vs Azure application rule
• User-ID vs Identity Awareness vs SAML / IdP on a proxy
• SNAT / DNAT / hide NAT / U-turn / Azure SNAT private ranges
• What “equivalent policy” actually means on a change ticket

• Export from PAN-OS / Panorama: security, NAT, objects, User-ID, decryption, GlobalProtect, IPsec
• App-ID → Check Point applications / services — what you lose when you fall back to port
• User-ID / group mapping → Identity Awareness + AD / IdP
• Zones + vsys → layers, policy packages, CMA / MDS notes
• NAT (source, dest, bi-dir, U-turn) → Check Point NAT hide / static / manual
• Decryption profile and exceptions → HTTPS Inspection on Check Point
• IPsec / GlobalProtect leftover: stay on PA, move to Check Point Remote Access, or go ZTNA
• Lab evidence: 20-rule sample mapped, unused objects dropped, residual-risk column filled

• SmartConsole / API export: layers, sections, implied rules, NAT, VPN communities, Identity Awareness
• Implied rules and “cleanup” — what PAN-OS will not do for you
• Ordered layers → one security rulebase + tags + log-forwarding
• Identity Awareness → User-ID agents, CIE, group mapping
• VSX / VS → VSYS or separate PA-VMs + Panorama device groups
• HTTPS Inspection → SSL Forward Proxy / Inbound Inspection + decryption exclusions
• What Expedition / Excel mapping can do — and what you still verify by hit-count
• Lab evidence: one layer converted, implied-rule sheet, User-ID test user

• Shadow NAT, overlapping subnets, hairpin, port-overload
• Site-to-site: proxy-ID / TS vs Check Point VPN community / encryption domain
• HA pair cutover: active/passive, session sync, what flaps on failover day
• Decryption exceptions: banking, cert-pinning, health apps — migrate the exception list first
• Say this on the bridge: “identity and decrypt stay last; NAT and VPN go first”

• How to run both firewalls on a pilot VLAN / PBR / VR without a loop
• Compare logs: session vs SmartView / logs vs Panorama
• Hit-count after 7 days — what you decommission vs what you keep
• Rollback: default route, NAT, VPN, identity. Who owns each line
• Dummy ticket: Monday 09:00 “finance cannot reach SAP”

• What Bluecoat actually is: ProxySG, Management Center, Reporter, WCCP, PAC, CPL
• Traffic steering today vs Zscaler: WCCP / explicit PAC / WPAD → GRE / IPSec / PAC / ZCC / Z-Tunnel
• CPL and VPM policy → ZIA URL Filtering, Cloud App Control, Firewall, File Type
• SSL intercept on ProxySG → ZIA SSL Inspection + custom CA + exclusions
• Authentication realms (IWA, LDAP, SAML) → ZIA IdP / ZCC / SCIM
• What you do not migrate 1:1: CPL edge cases, ICAP chains, local exceptions that nobody documented
• Lab evidence: PAC rewritten, 15 CPL rules mapped, SSL exception list, one IdP test user

• ICAP to DLP / AV → ZIA DLP engines, ATP, sandbox, CASB
• Bandwidth / QoS on the proxy vs ZIA Bandwidth Control
• Explicit vs transparent; guest Wi-Fi; PAC failover if Zscaler is unreachable
• When a small ProxySG stays as a break-glass or OT exception
• Decommission checklist: WCCP, default gateway, PAC URL, cert on laptops

• Why this happens: M&A, cost, data-residency, Prisma / Netskope already bought
• Export what matters: forwarding, SSL, URL, Cloud App, DLP dictionaries, IdP, PAC, ZCC profiles, NSS
• ZIA → Netskope SWG / CASB: steering, Real-time Protection, SSL, IdP
• ZIA → Prisma Access / SWG: Mobile Users, Service Connections, URL, decryption, CIE
• ZIA → on-prem SWG (Bluecoat / Forcepoint / Cisco): PAC reverse, explicit proxy, SSL CA swap
• ZPA leftover: do not dump ZTNA into a proxy. Keep ZPA, move to Prisma ZTNA, or leave as-is
• Lab evidence: one department PAC pointed at the new SWG; SSL CA; URL allow-list parity check

• What ASA is doing today: ACL, NAT, inspect, URL-filter / CSC / FirePOWER module, AnyConnect
• Internet egress to ZIA / SWG: default route vs PBR vs PAC vs AnyConnect trusted network
• AnyConnect vs ZPA / ZIA — split-tunnel, posture, what the ASA still terminates
• ASA URL-filter / regex → ZIA URL + Cloud App. Inspect http/https is not SSL intercept
• What stays on the ASA or FTD: site-to-site VPN, DC east-west, inbound DNAT, OT
• Lab evidence: one user VLAN PAC/ZCC, ASA no longer NATs internet, VPN users still work

• When Azure Firewall is the right box (hub-spoke, landing zone) and when it is not (App-ID, User-ID, GP)
• Basic vs Standard vs Premium: IDPS, TLS inspection, URL, web categories
• Classic rules vs Azure Firewall Policy (the one you should migrate to)
• Map on-prem: security rule → network / application / DNAT / NAT rule collection groups
• SNAT private ranges, forced-tunnel, UDR, and why “default route to Firewall” breaks on-prem return path
• Hub-spoke + Firewall Manager + secured virtual hub vs hub-VNet
• Lab evidence: 10 on-prem rules become a Policy; spoke UDR; SNAT check from a test VM

• Premium TLS inspection and IDPS — cert, key vault, what breaks (pinning, private CA)
• Easy SKU change Standard ↔ Premium vs manual rebuild
• Coexistence: on-prem NGFW still owns branches / VPN; Azure Firewall owns Azure egress / east-west
• Application Gateway WAF vs Azure Firewall — who sits where
• NSG is not a firewall replacement. Use both, say why
• Logs to Log Analytics / Sentinel. What you hunt after cutover

• No App-ID / User-ID / GlobalProtect. Cloud NGFW, Prisma, or keep a PA-VM
• Inbound published apps: Firewall DNAT vs App Gateway vs Front Door
• Hybrid identity: Entra ID, private DNS, resolver, on-prem AD return path
• Decision table: Azure Firewall only / Firewall + NGFW / Firewall + SASE

• Change window template: T-7 inventory freeze, T-1 pilot sign-off, T0 cut, T+2 hypercare
• Bridge roles: network, firewall, proxy, IdP, app owner, comms
• Go / no-go checks: health of new path, IdP, SSL, NAT, VPN, PAC, UDR
• Rollback in 15 minutes: default route, PAC, UDR, NAT, DNS. Named owner
• Hypercare board: top 20 apps, war-room Slack / Teams, 48-hour log compare

• Weak vs strong: “we migrated to Zscaler” vs “PAC + ZCC for campus, GRE for DC, SSL exceptions first, dual-run 14 days”
• PA → CP and CP → PA in 90 seconds
• Bluecoat CPL to ZIA: what you map, what you drop
• ASA to proxy: what stays on the ASA
• Azure Firewall: Policy + UDR + SNAT + what you still need an NGFW for
• Practice desks: Palo Alto · Check Point · Zscaler · Azure

• Pick one of the six tracks. Submit: inventory sheet, mapping table, dual-run plan, weekend MoP, rollback
• 30 judgment MCQs (not trivia) + one broken-cutover ticket
• Exam map recap: NGFW Engineer / CCSA-CCSE topics / ZDTA / AZ-500 Firewall
• Techclick Infosec completion certificate after capstone + knowledge check

₹25,000 for the full 16-module Firewall & Proxy Migration course. Workbook, recordings, six playbooks, interview practice and the Techclick certificate are included. Vendor exam vouchers are not included unless a batch offer says so.

No. Module 2 teaches the mapping language. If you want deep admin on one box first, take the matching vendor syllabus and join this as the project layer.

Class uses dummy exports and recorded labs. You may bring a sanitised export of your own (no secrets, no customer names) for the capstone. We never paste live credentials into chat.

Often no. It is the right Azure-hub control. App-ID, User-ID and GlobalProtect still need an NGFW, Prisma or Cloud NGFW. Module 13 is the decision table.

16 live classes, typically Sat & Sun 9:00–11:00 PM IST. WhatsApp +91 92772 29456 for the next start date.