Project overview:
Policy migration: Move the remaining customer firewall policies and ACLs from legacy firewalls to existing Palo Alto virtual systems (vsys). Tighten rules so only required traffic is allowed, while keeping customer connectivity intact.
Hardware refresh: Replace end-of-life Palo Alto firewalls with new hardware. Use repeatable migration packages to carry over policy, NAT, routing, VPNs, high availability, logging and monitoring.
Key responsibilities:
Collect inventory and configurations, and identify affected tenants, dependencies and readiness gaps.
Prepare migration workbooks, proposed configurations, policy comparisons and change workplans for client review.
Convert ACLs and security policies into Palo Alto rules and validate the required application flows within each virtual system.
Create cabling and connectivity plans, including port mappings, and submit install requests for on-site remote hands teams.
Load the approved PAN-OS software on replacement firewalls and verify that it is ready before configuration and testing.
Stage and test configurations, support client-led production cutovers, troubleshoot assigned issues and record validation results.
Keep work items and progress updates current, and maintain configuration backups, as-built documentation and operational handoffs.
Required qualifications:
Strong hands-on experience with Palo Alto PAN-OS and Panorama, including device groups, templates, virtual systems and HA pairs.
Ability to convert ACLs and security policies into Palo Alto rules, validate application flows and restrict access to required traffic.
Solid routing and troubleshooting skills, including BGP, IPsec VPNs, packet captures, application connectivity and firewall logs.
Experience with firewall migrations, including configuration mapping, pre-checks, testing, rollback plans and change documentation.
Ability to work with engineers, application owners, customers and third parties in a large data center environment.
Preferred qualifications:
Experience with Cisco ASA
Automation experience with Ansible and/or Python
Experience with large firewall refresh programs and multi-tenant environments
Experience with work-tracking tools such as Jira