How much does a Palo Alto Networks migration cost in the UK?

Fixed-price from £20,000 for a single site, £70,000–£95,000 for up to 10 sites, and £140,000–£190,000 for 20+ site estates. Final price is confirmed in a written Statement of Work within five working days of a scoping call. Larger estates are bespoke.

Can you migrate from Cisco ASA, Fortinet or Check Point to Palo Alto Networks?

Yes. We specialise in rule-by-rule conversion from Cisco ASA, Fortinet FortiGate, Check Point and legacy Palo Alto Networks devices, including NAT, routing, IPsec, GlobalProtect and HA pair commissioning.

What is the payment structure?

50% on signature of the Statement of Work, 50% on signed acceptance test. No time-and-materials, no change-request creep.

Is Cablewise inside or outside IR-35?

Outside IR-35. Cablewise delivers a fixed-price contracted outcome (a Statement of Work with acceptance criteria), not labour-hire — you receive a deliverable, not timesheets.

Book scoping call

For MSP partners ↗ Palo Alto Networks Migration Specialists

Fixed-price Palo Alto Networks migrations for UK mid-market.

Locked Statement of Work in 5 working days. Fixed price, 50/50 payment, written acceptance test. From Cisco ASA, Fortinet, Check Point or legacy PANW — no T&M creep, no surprise change requests.

Book a 30-min scoping call See pricing

Migrate from

Is this you?

You bought Palo Alto. Now you need it delivered without drama.

The hardware is racked, the licences are signed, and the steering committee wants a date. The integrator wants a Statement of Work the size of a phonebook.

01 — Cost certainty

Finance wants a firm number, not a T&M estimate

You've been burned by "day-rate plus expenses" engagements that doubled mid-flight. Board sign-off needs a single line item — and a date it won't move.

02 — Risk control

One bad cutover weekend is one too many

Production traffic. Audit deadlines. The IT director's bonus. You need a migration partner who has done this on enterprise gear before — not a generalist learning on your kit.

03 — Vendor pressure

Renewal is twelve months out and the clock is ticking

The legacy estate is end-of-sale or end-of-support. You can't carry both stacks indefinitely, and the PANW order has a use-or-lose clause. Move once. Move well.

What we deliver

Five fixed-scope Palo Alto Networks services. Each priced before we start.

Every engagement ships with a written acceptance test, a runbook your team can re-execute, and a defined hand-back date. No discovery phase that lasts three months.

S—01

NGFW Migration

Rule-by-rule conversion from Cisco ASA, Fortinet, Check Point or legacy PA-series — including NAT, routing, IPsec, GlobalProtect and HA pair commissioning. Cutover rehearsed twice before the change window.

1 – 20+ sites / From £20K

S—02

Panorama Deployment

Centralised management for fleets that have outgrown per-device admin. Template stacks, device groups, log collectors, and a hardened RBAC model your security team can defend at audit.

HA pair / From £18K

S—03

Prisma Access

SASE for remote workers and branches — service connections, mobile users, traffic steering, IdP federation, and the bandwidth maths to right-size your tenant. Pilot in two weeks, full rollout in eight.

Tenant + rollout / From £35K

S—04

Strata Cloud Manager

Onboard your estate to PANW's cloud-delivered management plane. AIOps tuning, Best-Practice Assessment baseline, and licence reconciliation so you stop paying for SKUs you don't run.

Estate onboarding / From £15K

S—05

Policy Health Assessment

A two-week deep audit of an existing PANW deployment: shadowed rules, unused objects, App-ID coverage gaps, decryption posture, and a prioritised remediation backlog. Output: a 40-page report, not a sales deck.

2 weeks / From £10K

Pricing

UK Palo Alto Networks migration pricing — one sheet, no hidden fees.

Ranges below reflect typical scopes. Final fixed price is confirmed in writing after a one-hour scoping call and review of your existing config exports.

Tier	Service & scope	Fixed price (GBP)
SCOPE	Scoping engagement Discovery call, config-export review, written fixed-price Statement of Work — credited against the migration if signed within 60 days.	£4,000
NGFW · S	NGFW Migration — Single site HA pair, one location. Cisco ASA, Fortinet, Check Point or legacy PA.	£20,000 – £35,000
NGFW · M	NGFW Migration — Up to 10 sites Branch fleet plus core. Phased cutover with rehearsed change windows.	£70,000 – £95,000
NGFW · L	NGFW Migration — 20+ sites Enterprise estate. Wave plan, regional cutovers, Panorama-fronted.	£140,000 – £190,000
MGT	Panorama Deployment HA pair, template stacks, device groups, log collectors, RBAC.	£18,000 – £28,000
SASE	Prisma Access Mobile users + remote networks, IdP federation, traffic steering.	£35,000 – £55,000
SCM	Strata Cloud Manager Estate onboarding, AIOps tuning, BPA baseline, licence reconciliation.	£15,000 – £22,000
AUDIT	Policy Health Assessment Two-week audit. Shadowed rules, App-ID gaps, decryption posture.	£10,000 – £14,000
XL	Enterprise estate — 50+ sites, multi-region Bespoke wave plan, multiple change windows, regional engineers, programme-level governance.	Talk to us

NGFW · S

NGFW Migration — Single site

HA pair, one location. Cisco ASA, Fortinet, Check Point or legacy PA.

£20,000 – £35,000

NGFW · M

NGFW Migration — Up to 10 sites

Branch fleet plus core. Phased cutover with rehearsed change windows.

£70,000 – £95,000

NGFW · L

NGFW Migration — 20+ sites

Enterprise estate. Wave plan, regional cutovers, Panorama-fronted.

£140,000 – £190,000

MGT

Panorama Deployment

HA pair, template stacks, device groups, log collectors, RBAC.

£18,000 – £28,000

SASE

Prisma Access

Mobile users + remote networks, IdP federation, traffic steering.

£35,000 – £55,000

SCM

Strata Cloud Manager

Estate onboarding, AIOps tuning, BPA baseline, licence reconciliation.

£15,000 – £22,000

AUDIT

Policy Health Assessment

Two-week audit. Shadowed rules, App-ID gaps, decryption posture.

£10,000 – £14,000

All fixed scope. 50 / 50 payment — half on signature, half on signed acceptance test.

How a migration works

How a UK Palo Alto Networks migration works — four phases.

You'll know what is happening in your network in any given week, who is doing it, and what "done" looks like before we begin.

Phase 01

Scope & price

30-minute discovery call followed by config-export review. You receive a written fixed-price Statement of Work within 5 working days.

~1 week

Phase 02

Design & build

HLD & LLD signed off. Lab build of the target estate. Rule conversion, App-ID mapping, decryption strategy. Rehearsals.

2 – 6 weeks

Phase 03

Cutover

Pilot site goes first. Rollback documented. Subsequent waves on agreed change windows. Engineer on the bridge throughout.

1 – 8 weeks

Phase 04

Acceptance & hand-back

Written acceptance test. Runbooks, BPA report, as-built docs. Your team owns the estate. Final 50% invoice raised.

~1 week

Founder & Principal Engineer

Led by Israel Silva.

Certified Palo Alto Networks Principal Engineer. Fifteen-plus years architecting and operating production networks where downtime isn't an option — hyperscale media, regulated financial services (PCI-DSS), offshore energy datacentres, UK telecom, and global IT consultancy.

Currently Principal Network & Cybersecurity Consultant, focused on SASE / SSE / Zero Trust architectures. Cablewise is how I deliver Palo Alto Networks migrations outside that day job — same engineering depth, fixed-scope, fixed-price, partner-only model.

You're not buying time on a recruiter's bench. Cablewise delivers with a small, hand-picked group of senior network engineers I've worked alongside for years — same standards, same accountability, scaled to fit scope.

PANW Certified SASE SSE Zero Trust NGFW Panorama Prisma Access SCM PCI-DSS

Connect on LinkedIn

Common questions

What procurement always asks before signing.

If you're shortlisting Cablewise alongside a Tier-1 integrator, these are the answers you'll want before the second meeting.

What is your IR-35 status?

Outside IR-35. Cablewise delivers a fixed-price contracted outcome — a Statement of Work with written acceptance criteria — not labour-hire. You receive a deliverable, not timesheets.

What happens if scope changes mid-flight?

Change requests are priced within 48 hours at the agreed day-rate set in your SoW. You approve in writing before any work proceeds. The original fixed price is never silently inflated.

What happens if an engineer drops off mid-engagement?

Every engagement has a named primary engineer and a named backup engineer at signature. Continuity is the company's problem, not yours.

Do you handle out-of-hours and weekend cutovers?

Yes. OOH and weekend cutover windows are included in the fixed scope when the migration plan requires them — there is no separate OOH rate.

Do you mark up Palo Alto Networks hardware or licences?

No. Hardware and licence procurement is pass-through at cost. You see the supplier invoice. We make our margin on engineering, not on box-shifting.

What insurance do you carry?

Professional Indemnity and Public Liability cover are in force. Certificates of cover are provided on signature of the NDA — standard UK B2B procurement.

Can you provide SC-cleared engineers?

SC-cleared engineers are available on request for regulated or public-sector engagements. State the requirement at scoping and we'll confirm bench availability before SoW signature.

Next step

Get a fixed price in writing within five working days.

Book a 30-minute scoping call. Bring your current vendor, your site count and your renewal date. You'll leave with a clear path off your legacy estate.

Book a 30-min scoping call White-label Palo Alto delivery for UK MSPs

Book your slot

Book a 30-min scoping call.

Pick a time below. The form takes 30 seconds. You'll get a calendar invite with the join link the moment you confirm.