topic Re: Palo to Palo migration in Expedition Discussions

Palo to Palo migration

AurelioTassone — Fri, 13 Nov 2020 05:52:26 GMT

Hi all,

I have a few questions regarding doing a palo to palo migration:

- Are there any best practices for doing a Palo to Palo migration via Expedition

- Is there any difference in uploading an palo config xml to migrate as opposed to API call?

- What parts of a palo config are not migrated through expedition? For example I have noticed zone protection profiles don't migrate

Re: Palo to Palo migration

lychiang — Fri, 13 Nov 2020 17:45:20 GMT

Hi @AurelioTassone

Normally, for Palo Alto Networks to Palo Alto Networks migration, you can export the configuration from the old firewall and import and load the configuration to the new firewall. There might be interface renaming needed between different models, you can do a search and replace the interface name in XML file directly.

In terms of the difference when importing the configuration in Expedition, retrieve it directly through API call if you have a direct connection between the PAN-OS device and Expedition. If not, you can manually export the configuration and upload it.

If the zone protection profile is in your original file, it will be migrated.

Re: Palo to Palo migration

BenKnorr2 — Tue, 24 Nov 2020 22:53:24 GMT

Certificates are another thing that don't exist in Expedition and can't be migrated. For Palo to Palo, I would usually recommend just exporting full xml config and importing into target firewall. Before committing on target firewall, adjust physical devices as needed, especially management and dataplane interfaces. If you have Panorama, even better for the migration since you can leverage device groups and templates. If you need to mix-match stuff in those containers in panorama, expedition is a very helpful tool for that.

Re: Palo to Palo migration

renzanjo11 — Tue, 17 Oct 2023 08:23:23 GMT

Hi @BenKnorr2 @lychiang I have a follow up question on this one.

I’d like to ask about interface migration using XML file.

Because the port density of PA-460 and PA-3020 is different.

So, we plan to change some interfaces to trunk port.

Area	PA-3020	PA-460
WAN Primary	E1	E1
LAN	E2	E2
WAN Secondary	E3	E3
Guest	E4	E4
Voice	E5	E5
SOC	E6	E6 (Trunk)
WAN Voice	E7	E6 (Trunk)
PAM	E8	E6 (Trunk)
HA 1	HA port	E7
HA 2	HA port	E8

In that case, what is your recommended procedure?

[example]

1) customize the export xml and import.

2) export and import, ignore error and amend manually.

3) delete the <ethernet> part of xml and add interface manually.

4) using partial import command and add interface manually.

Regards,

Renz

Re: Palo to Palo migration

delliott_6784 — Tue, 17 Oct 2023 12:49:57 GMT

Recommend importing the XML file into Expedition 1.0 to remap the interfaces and do some cleanup while you're at it.

Re: Palo to Palo migration

sbagh — Sat, 28 Dec 2024 23:59:10 GMT

Export the device-state of the old firewall and import it to the new firewall; check for the interfaces, If it has the same interfaces nothing else is needed to be configured extra, if the number of interface doesn't match, you can add the new interfaces manually...
Importing a device-state is better as sometimes if you go with the just the .merged_running_config of the old firewall the certificate keys may give you some errors when you are committing the changes.