First, you will have to schedule a deployment task on the ePO 3.X server to *uninstall* Desktop Firewall. The HIP installer won't uninstall Desktop Firewall so this will be the only way to get it off the systems and install HIP. Once all the machines have MDF removed, you can add the to the new ePO server and deploy the agent. This should get them to start communicating to the new ePO server. Since there is an upgrade path from VSE 8.5 to VSE 8.7 and ePO 4.5 supports VSE 8.5, you should be able to check in the VSE 8.5 extension into ePO 4.5 and manage the installs of VSE 8.5 and deploy VSE 8.7 over them without issue.