Comment # 3 on bug 1091968 from Matthias Gerstner

This topic seems still to be a source of confusion. I discussed this with
firewalld maintainer Markos Chandras a while ago and it turned out that the
migration from SuSEfirewall2 to firewalld using his helper packages
"susefirewall2-to-firewalld" is only possible if both firewalls are installed.
This means that removing SuSEfirewall2 will break this migration path.

I asked Markos to check if an offline migration would not also be possible but
I don't know if he found time to implement it.

I even tried to introduce a Conflicts to achieve removal of SuSEfirewall2
after upgrading but this only resulted in more troubles as outlined in bug
1084177 and bug 1085260.

So as far as I understand it at the moment:

- SuSEfirewall2 should *not* be forcibly removed after upgrade to support the
  upgrade path using susefirewall2-to-firewalld
- sadly, if both firewalls are installed and *enabled* in systemd then strange
  things can happen (on systemd level the two firewalls can preempt each other
  multiple times).