The invention discloses a session migration method and device, and a firewall, relates to the technical field of a computer and mainly solves the problem that the throughput performance of the firewall is low due to the fact that sessions on CPU cores are distributed unevenly. The method comprises the steps of calculating the average number SESSavg of sessions distributed to each core; obtaining the CPUmax core to which the maximum number SESSmax of sessions are distributed and the CPUmin core to which the minimum number SESSmin of sessions are distributed; migrating the sessions on the CPUmax core to the CPUmin core; generating filter structure information of the migrated sessions according to attribute information of the migrated sessions; and issuing the CPUmin attribute information corresponding to the migrated sessions and the filter structure information to network cards corresponding to the migrated sessions, thereby enabling the network cards to distribute the data of the migrated sessions to the CPUmin core. The method, the device and the firewall are mainly used for improving the throughput performance of the firewall.