Hi,

I would recommend upgrading to 3.2 or later before migrating just for this reason.

If you are unable to upgrade, check out these scripts that may help creating the IPsets:

https://github.com/lcamarda/v2tlivefire/blob/main/nsxv-secgroups-to-ipsets.ps1

https://github.com/lcamarda/blog/blob/master/nsxv-secgroups-to-ipsets.ps1

They are the same thing, only difference the first one you specify the SG to which you want to add the IPset, the second does the same for all the SGs in the NSX-V configuration.

DFW will be in effect on both NSX-V and NSX-T during migration, but your VMs will not be protected when they are migrated out of the source vCenter since the VM object is no longer there, so you need to use IPsets.