topic Re: PANOS 8.1 to PANOS 10.2 migration using expedition in Expedition Discussions

PANOS 8.1 to PANOS 10.2 migration using expedition

matthias.fremont — Tue, 04 Jul 2023 09:33:25 GMT

Hello

I have an old PA5050, running PANOS 8.1.24.

I need to replace it with a new PA3410 running PANOS10.2

I trying to find the best way to migrate my configuration from my PA5050 to my new PA3410.

Can expedition can help me to do that ?

Any other idea ?

Thanks

Re: PANOS 8.1 to PANOS 10.2 migration using expedition

dpuigdomenec — Tue, 04 Jul 2023 12:15:05 GMT

Hi @matthias.fremont

Thanks for reaching out.

Expedition is intended to be used when migrating from a 3rd party vendor to Palo Alto Networks.

Given your use case the simplest path is to export your running configuration from your old device and import into your new one.

By executing this action the new device will migrate automatically the running configuration. Maybe is required you reenter shared keys for your VPN configuration using the GUI due to PANOS latest versions are not expecting the keys in plain text.

Another option, if possible, is to upgrade the old device to PANOS 10.2 and then export the upgraded configuration, in the below link you have information on how to do that: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path

Hope this helps,

Best regards,

David

Re: PANOS 8.1 to PANOS 10.2 migration using expedition

SteveKrall — Tue, 11 Jul 2023 03:00:39 GMT

This is what I would try first. Disable HA on one firewall and save the candidate config as a named xml file. Do not commit the change. Revert to running after you have the config file. Export the file and open in a text editor like Notepad++. You will see in the first 5 lines of code a reference to your 8.1.x version of code. Change this to 10.2.0 and save the file. Then import the file to the new hardware, load named config and commit. Then configure HA manually. Palo changed the naming convention for HA ports so your PA-5000 will reference interfaces that do not exist on a PA-3400 and commit will fail. One other option is the cli command "load config partial". But editing the version number in the xml is the easiest and fastest method.

Re: PANOS 8.1 to PANOS 10.2 migration using expedition

campocaceres — Thu, 14 Dec 2023 18:53:34 GMT

Hi @matthias.fremont,

Were you successful in getting this going? Did you follow @SteveKrall's recommendations? I'm getting ready to do a very similar migration, and curious how your experience went and if you have any other caveats.