Migrating configuration from the firewall running PAN-OS 9.1 to new firewall running PAN-OS 11.1 directly

Tutchapon — Tue, 20 Aug 2024 09:18:43 GMT

Hi LIVEcommunity

I plan to migrate the configuration from a PA-3020 firewall currently running PAN-OS 9.1 to a new PA-1410 firewall running PAN-OS 11.1.

I'd like to know if it's possible to directly import the configuration from the older firewall to the newer one, despite the difference in PAN-OS versions.

If direct import isn't recommended, please advise on the best practices and any necessary steps to ensure a successful migration.

Re: Migrating configuration from the firewall running PAN-OS 9.1 to new firewall running PAN-OS 11.1 directly

TomYoung — Tue, 20 Aug 2024 14:46:12 GMT

Hi @Tutchapon ,

I completely understand that the latest version of the PA-3020 is 9.1, and the minimum release of the PA-1410 is 11.0. So, you cannot match the PAN-OS. https://docs.paloaltonetworks.com/compatibility-matrix/supported-os-releases-by-model/palo-alto-networks-next-gen-firewalls#id9680433e-055f-4f38-a7d0-6d31e7d557bc

I have imported lower configurations (all 10.x) into PAN-OS 11.x, and they have worked great! The new NGFW automatically converted the configurations. I would definitely recommend you import directly to the PA-1410 to see if it works. It would save you a lot of time. If you do run into commit errors, we can assist.

Other options are to use a 3rd NGFW that can bridge the PAN-OS gap, or the migration tool (Expedition), but these will all take more time.

Thanks,

Tom

topic Migrating configuration from the firewall running PAN-OS 9.1 to new firewall running PAN-OS 11.1 directly in Next-Generation Firewall Discussions

Migrating configuration from the firewall running PAN-OS 9.1 to new firewall running PAN-OS 11.1 directly

Re: Migrating configuration from the firewall running PAN-OS 9.1 to new firewall running PAN-OS 11.1 directly