Migration from PA-3060 to PA-3260

AlexYSTan — Wed, 03 Jan 2024 07:14:25 GMT

I'm seeking advice regarding a migration from a PA-3060 HA pair with PAN-OS v9.1.X to PA-3260 HA pair v10.2.X.

I understand that to have minimal issues for the migration, it is recommended to have the same OS version. From the Compatibility Matrix shown here, I can see that I am able to downgrade PA-3260 to version 9.1.X for the migration. https://docs.paloaltonetworks.com/compatibility-matrix/supported-os-releases-by-model/palo-alto-networks-next-gen-firewalls

I found this post from 2020, would like to ask if this is the best practice/best way to proceed with this migration?

https://live.paloaltonetworks.com/t5/general-topics/3050-to-3250-hardware-upgrade/td-p/347699

In that post, they mentioned "Additionally, if you follow the advice of ensuring they are on the exact same panOS release prior to moving over the config, make sure its a preferred release. I made the mistake of downgrading my 3250's to a panOS release matching my 3050's prior to the switch over and got hit by this bug in the next release, it was a rough day."

PAN-121626.

So from what I understand here, I have to upgrade the existing PA-3060 to the preferred release to be safe and avoid that issue?

Any advice would be much appreciated.

Thank you.

Alex

Re: Migration from PA-3060 to PA-3260

vsurresh — Wed, 03 Jan 2024 10:41:44 GMT

Can you not first upgrade your current firewall to the preferred release say 10.x.x and then migrate instead of the other way around? this is what I would do if I were you.

Re: Migration from PA-3060 to PA-3260

AlexYSTan — Wed, 03 Jan 2024 10:50:25 GMT

Hi @vsurresh existing firewall PA-3000 series cannot upgrade beyond v9.1.x. I would love to migrate it that way too. Unfortunately, it is EoS.

topic Re: Migration from PA-3060 to PA-3260 in Next-Generation Firewall Discussions

Migration from PA-3060 to PA-3260

Re: Migration from PA-3060 to PA-3260

Re: Migration from PA-3060 to PA-3260