topic Re: Preparing PA-440 for connection with Expedition in Expedition Discussions

Preparing PA-440 for connection with Expedition

UNMPDgordon — Fri, 18 Nov 2022 00:14:58 GMT

Greetings from a PA/Expedition noob...

My end result is to migrate from a Cisco ASA 5505 to a PA-440.

So...

I've got VMware Workstation Player (VMWP) installed on a spare Win 10 pc;

I've got Ubuntu server 20.04 instance (UBS) installed in the VMWP;

I've got the latest Expedition installed into the UBS;

I can launch Chrome on the Win 10 PC and logon successfully to Expedition;

The single "remediation" issue shown in the Expedition GUI is fixed, so expedition is happy.

Next, using a console connection and PuTTY on a spare Win 10 laptop, i powered up the PA-440;

I reset the admin password;

I don't have Panorama, so I disabled ZTP at the CLI;

I disconnected the console connection and connected the laptop to the Mgmt port;

I've logged in successfully to the PA-440 webgui.

Is there a specific PA document that I should be using to configure the PA-440 so I can connect it to my LAN (trust side of the ASA) and then use Expedition per the video tutorial?

https://www.youtube.com/watch?v=-gbQ-YcgoPs&list=PLD6FJ8WNiIqVez8EBeoyRsnQcKTA5FuZ-&index=1

(There's a big gap of knowledge between video part 1 and part 2)

Thanks in advance.

Gordon

Re: Preparing PA-440 for connection with Expedition

lychiang — Fri, 18 Nov 2022 02:18:28 GMT

For PA to PA migration, you can export the running config from the old device and import and load into the new device . There is no need to use expedition . If you have any questions, please open a TAC case .

Re: Preparing PA-440 for connection with Expedition

Metgatz — Fri, 18 Nov 2022 06:42:23 GMT

Hello @UNMPDgordon

I am not entirely clear what your problem is ? What exactly is it where you need support? What exactly are you having doubts about or are you stuck on?

I remain attentive

Regards

Re: Preparing PA-440 for connection with Expedition

UNMPDgordon — Fri, 18 Nov 2022 15:19:05 GMT

Apologies for the blunt response but I did make it clear in my second sentence that I'm migrating from a Cisco ASA 5505 to a PA-440.

Re: Preparing PA-440 for connection with Expedition

UNMPDgordon — Fri, 18 Nov 2022 15:27:54 GMT

I'm stuck at not knowing what to do next with the PA-440 (finish the basic config) so I can connect it to my LAN so I may then use Expedition to migrate the settings and rules from my Cisco ASA to the PA-440.

With all due respect, I thought my explanation on what I've done and my question about what PA document was pretty clear...

Re: Preparing PA-440 for connection with Expedition

lychiang — Fri, 18 Nov 2022 15:58:07 GMT

@UNMPDgordon to obtain pan-OS base config, you can either export the running config from PA-440 and import it in the expedition, or add a device in expedition and use API to retrieve the running config from PA-440

Re: Preparing PA-440 for connection with Expedition

UNMPDgordon — Fri, 18 Nov 2022 18:42:06 GMT

With all due respect Lychiang, you're not reading the original question fully.

The Cisco ASA is our active FW, the PA-440 is fresh outta the box with the steps completed as outlined in my OP.

I need to _prepare_ the PA-440 so I can connect it to my LAN so that I _can_ add it to Expedition and _then_ follow the step sequence in the videos I linked to.

Please reread my original question carefully before responding again!

I will not accept as a "solution" responses that don't answer the question posed in the OP.

Re: Preparing PA-440 for connection with Expedition

lychiang — Fri, 18 Nov 2022 19:55:20 GMT

@UNMPDgordon for connecting your PA-440 firewall to the network, you can refer below article :

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClS2CAK

If there is any questions on setting up your PA-440 , please open a TAC case , our TAC can help you on the task.

Re: Preparing PA-440 for connection with Expedition

UNMPDgordon — Fri, 18 Nov 2022 20:06:49 GMT

Thank you.

Your link is to an older version but it _is_ a proper answer.

I found this article (similar but newer) a short time ago:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/getting-started/integrate-the-firewall-into-your-management-network/perform-initial-configuration