topic Can Expedition migrate from PA200 to PA440? in Expedition Discussions

Can Expedition migrate from PA200 to PA440?

jchen5 — Sun, 20 Nov 2022 00:04:21 GMT

I would like to migrate from PA-200 (with OS 8.1.24) to PA-440 (with OS 10.1.3). Can Expedition migrate from Palo Alto to another model or Expedition can only migrate from other vendors to Palo Alto?

Re: Can Expedition migrate from PA200 to PA440?

AbhijeetBhapkar — Fri, 25 Nov 2022 06:54:46 GMT

For PA to PA migration, does not require an expedition tool, you can easily export the running config as a xml fle from the old PA and import the file back to the new PA .

Re: Can Expedition migrate from PA200 to PA440?

jchen5 — Mon, 28 Nov 2022 16:35:11 GMT

Thank you very much for your feedback. I did try it but failed. The latest OS for PA200 is 8.1.24; however, PA440 cannot downgrade to 8.1.24 OS. Both firewalls don’t have the same OS so when I export the running config as an XML file, it will give you an “Invalid syntaxes” message.
I did try the Expedition tool, it can move address objects and Security policy; however, it cannot move “profile”.

Re: Can Expedition migrate from PA200 to PA440?

lychiang — Mon, 28 Nov 2022 17:02:23 GMT

@jchen5 You could try load config partial command on PAN-OS firewall, it should be able to load partial config from the old config to the new device.

Re: Can Expedition migrate from PA200 to PA440?

MNagel — Mon, 28 Nov 2022 17:06:32 GMT

What I've generally done for these kinds of migrations is to export the
config in set format, edit interfaces as needed, then apply the result
to the new firewall. You _may_ run into some syntax changes across
versions, but you can identify them and correct after based on your
session log.

Regards,
Mark

Re: Can Expedition migrate from PA200 to PA440?

AbhijeetBhapkar — Mon, 28 Nov 2022 18:15:44 GMT

As per my understanding, you can use it in 2 ways
1) Need Zone and Interfaces mapping before exporting the XML file in Expedition Tool
2) Take the ssh p200 device and Run the following command to view the configuration:
> set cli config-output-format set
>configure and then execute the show command
3) Capture the view a configuration in "set" format and configure the same on PA440

refer below article for your ref.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHoCAK

Re: Can Expedition migrate from PA200 to PA440?

AbhijeetBhapkar — Mon, 28 Nov 2022 18:16:14 GMT

refer below article for your ref.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHoCAK

Re: Can Expedition migrate from PA200 to PA440?

AbhijeetBhapkar — Mon, 28 Nov 2022 18:23:35 GMT

Also, upgrade the hotfix Version 1.2.45 (Date Nov 28, 2022) which resolves the bug

Bug
MT-2512 - AutoZone feature - Security rule zones not properly calculated based on NAT when address object (src/dst) is an IP range

https://live.paloaltonetworks.com/t5/expedition-release-notes/expedition-1-2-45-hotfix-information/ta-p/522573