The 6.3 to 8.6 or 9.x version jump is large enough that you are probably better off writing a new configuration from scratch, than trying to find a migration path. Two of the big things to watch out for are:
* at 8.3, the NAT subsystem was completely rewritten. ACL's now use real addresses, not mapped. NAT rules use network objects, not ACL's.
* at 9.0, the v6 support was merged into the v4 access lists. "any" is dual-stack.
-- Jim Leinweber, WI State Lab of Hygiene