Migrate existing rules/objects from one device group to another

Tim_Grossner — Tue, 10 Jul 2018 13:48:46 GMT

Does anyone have a good set of steps to convert / migrate a policy from one device group to another, including all objects/groups/etc?

Re: Migrate existing rules/objects from one device group to another

sidetrack — Tue, 17 Jul 2018 02:13:41 GMT

I've done this in Panorama without using Expedition, by loading partial configs from one DG to another by loading a partial configuration from the source device group in the running-config as per https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-move-or-copy-objects-in-configuration-from-one-location/ta-p/71904

You need to start with the dependencies i.e. tags, addresses, address groups, apps, app groups, profiles, profile groups etc. then you can copy the policy. You can copy all pre- or post- rules at once by using the pre-rules or post-rules Xpath.

I found an old tech note for PAN-OS 6 quite helpful for this process https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Panorama-Device-Migration/ta-p/62527 even though the device migration process is largely automated today.

topic Migrate existing rules/objects from one device group to another in Expedition Discussions

Migrate existing rules/objects from one device group to another

Re: Migrate existing rules/objects from one device group to another