topic Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama) in AIOps for NGFW Discussions

Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

KumaraDev — Fri, 28 Jun 2024 20:53:42 GMT

We have many brownifeld firewall in production live network. Customer purchased AIOPs license and wanted to manage all the brownfield firewall from Strata Cloud Manager (SCM).

Is it possible to import the existing firewall configurations into SCM and manage it further?

Requesting everyone to provide an immediate answer for this scenario.

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

gregory109 — Sat, 29 Jun 2024 04:43:08 GMT

@KumaraDev wrote:

We have many brownifeld firewall in production live network. Customer purchased AIOPs license and wanted to manage all the brownfield firewall from Strata Cloud Manager (SCM).

Is it possible to import the existing firewall configurations into SCM and manage it further?

Requesting everyone to provide an immediate answer for this scenario.

Hello, @KumaraDev

To manage existing brownfield firewalls from Strata Cloud Manager (SCM), follow these steps:

Resource Configuration:
Create an OTDS Resource representing your existing firewall (e.g., PAN-OS firewall).
Configure the resource with the necessary access roles and permissions.
OAuth 2.0 Scopes:
Define appropriate OAuth 2.0 scopes for your firewall resource.
These scopes control the level of access granted to SCM.
Import Configuration:
Pull the existing firewall configuration using its XMLAPI.
Migrate the configuration into Strata Cloud Manager.
Testing and Validation:
Verify that the imported configuration works as expected within SCM.
Test various features and rules to ensure proper management.

I hope this info is helpful to you.

Best Regard,
Gregory Chavez

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

KumaraDev — Sat, 29 Jun 2024 18:27:57 GMT

Hi @gregory109,

Thank you for your response.

Since we are new to SCM platform, could you please guide me how to create an OTDS resource in SCM.

Please share if there is any documents for creating OTDS resource.

Regards,

KumaraDev

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

I.Fritchy — Wed, 23 Oct 2024 19:55:13 GMT

Hi @KumaraDev

I'm looking into doing the same thing as you are, though likely with fewer firewalls. Did you end up figuring out the OTDS resource? My SE indicated there is a Github repo with a Python script for moving the Panorama config into SCM but I have a blend of FWs in and out of Pano, I'd like to avoid putting them all into Pano just to put them all into SCM.

Regards

I.Fritchy

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

KumaraDev — Fri, 25 Oct 2024 07:53:27 GMT

Hi @I.Fritchy ,

As discussed with SCM product team, as of now only greenfield firewall can be onboarded and only manual configuration is possible in SCM console. They are working on including a feature to onboard brownfield firewalls into SCM and this feature will be updated into SCM in couple of months (tentatively).

If you get a chance, please try to reach Palo Alto SCM product team and get the latest udpate based your requirement.

I have already proposed the Product team to update SCM with all the features similar to Panorama. In that case, we can onboard greenfield and brownfield firewall into SCM which saves lot of implementation time and workload.

Regards,

KumaraDev

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

FabianKBCOM — Thu, 21 Nov 2024 16:24:22 GMT

Hello Kumara,

any news about "import existing firewall configuration" feature in SCM?

I heard that i will come with the latest November update. I asked our local SE to upgrade our environment but still cannot find any "import config" setting.

Kind regards.

Fabian

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

AtulK — Tue, 21 Jan 2025 18:34:09 GMT

Hi @KumaraDev,

Did you ever find out about importing existing firewalls onto Strata Cloud Manager? Thanks!

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

KumaraDev — Wed, 22 Jan 2025 12:31:15 GMT

We are planning to have a discussion with SCM product team soon. We will come to know the status only after that meeting. So please wait for some days.

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

Vadimus — Thu, 30 Jan 2025 05:48:07 GMT

Any update?

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

AtulK — Thu, 30 Jan 2025 10:29:51 GMT

Thank you!

I had a call with Palo Alto on this and it appears that there is a tool that they use to migrate the configuration, however I'm yet to see the tool in action. The tool is called Migration Manager. I'm not sure yet whether they will make this tool available to Partners and Distributors.

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

babyyoda — Fri, 07 Mar 2025 15:04:53 GMT

Yes! It is IMPERATIVE that partners have access to this tool. Especially those who are CPSP/ASP partners.

For information, I've seen a feature that need to be enabled by a SE that allows for a DEVICE import into SCM as a configuration snippet. Contat your SE and ask for the feature flag to be enabled on your SCM tenant.

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

AtulK — Fri, 07 Mar 2025 15:43:04 GMT

Thank you for providing the information regarding the feature to be able to import the existing device's configuration into SCM as snippets. I've already reached out to our SE (after reading your comment) to ask for this feature as a lot of our customers are looking to move to SCM.

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

B.Bavajula — Wed, 16 Apr 2025 12:09:08 GMT

Hi Team,

Please confirm whether import the existing device configuration feature was enabled on SCM ?. Looking for the valuable inputs.

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

I.Fritchy — Wed, 16 Apr 2025 15:08:19 GMT

Is this the original Github script process? Last time I spoke with my AE and Support (though was end of 2024) there was a Github script migration process that Palo formally decommissioned but still allows customers to use it, just won't support it.

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

V.Polana — Mon, 15 Sep 2025 11:01:47 GMT

Hi Team,

Can anyone confirm about migration tool?

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

AleksieSanchez — Tue, 17 Mar 2026 18:29:59 GMT

Are there any updates on migrating existing firewall local configuration without Panorama to SCM? Is there a migration tool available for this?

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

VinceM — Tue, 31 Mar 2026 08:51:15 GMT

Hi all,

Script on Ghit is not supported by Palo

Migration from Panorama to SCM is now released.

https://docs.paloaltonetworks.com/strata-cloud-manager/activation-and-onboarding/migrate-from-panorama-to-strata-cloud-manager

But, according info I have, no easy way to import devices which are not Panorama managed. Can be solved by creating a demo Pano, import device then back to the migration procedure 🙂

rgds

Re: Is there any way to import the configuration of brownfield firewall into SCM (simlar to Panorama)

KumaraDev — Tue, 31 Mar 2026 11:17:47 GMT

Till now there is no official public/internal document to migrate the configuration from Brownfield firewall into SCM. So, the best practice is to Onboard a Greenfield firewall into SCM.