Firewall already registered and upgrade path

FWPalolearner — Wed, 29 May 2024 17:46:34 GMT

Hello we have got a customer and they have purchased 5 X PA1400 series

Customer has CSP account and he registered one PA and it went well

but when he tried to register 2nd PA , it shows This serial number is already registered .

How is this possible ? Is this related to any Auth code or something ?

Secondly , customer has PA 3200 series which is EOL and now they want to have their policies moved to PA1400

PA 1400 comes with 11.x installed .

So what is the best approach to migrate ;

Can we directly import xml from PA 3200 to PA 1400 or

Do we first downgrade PA 1400 > upload the xml and then upgrade ?

Re: Firewall already registered and upgrade path

TomYoung — Wed, 29 May 2024 22:28:31 GMT

The S/N should not be already registered for a brand new NGFW. You would need to reach out to PANW support. It is not related to the auth code.

With regard to moving the configuration, yes, you can export and import. You said PA-3200 above, which is not EoL. If you meant PA-3000, then it will be more difficult because the PA-3000 max PAN-OS is 9.1 and the PA-1400 minimum PAN-OS is 11.0. https://docs.paloaltonetworks.com/compatibility-matrix/supported-os-releases-by-model/palo-alto-networks-next-gen-firewalls#id9680433e-055f-4f38-a7d0-6d31e7d557bc

You could try export and import from PA-3000 to PA-1400, but I am not sure how it will go.

For the PA-3200 to PA-1400, I would follow this process:

Upgrade PA-3200 to 11.1. See URL above.
Verify the 10G SFP+ interfaces on the old and new models. Some SFP slots are 1G only, and these are different between the models.(See URLs below.)
Export the XML from the PA-3200.
If the 10G interfaces needs to move on the new NGFW, search and replace in the XML is easiest.
Import the XML into the new NGFW. Modify the management interface back before committing.

Thanks,

Tom