topic Re: Migration problem from PA220 to PA540 - Virtual Router in Next-Generation Firewall Discussions

Migration problem from PA220 to PA540 - Virtual Router

daubsi — Sun, 08 Feb 2026 19:20:10 GMT

I want to migrate from a PA220 with PAN OS 10.2.17 to a PA540 with PAN OS 12.1.3.

I've exported the configuration from the old PAN, and imported in the new PAN. Everthing looks fine clicking through the various configuration settings.

However on commit there is a problem:

deviceconfig -> setting constraints failed : Disabling advanced routing is not allowed on this platform
deviceconfig -> setting is invalid

On the PA220 I had a Virtual Router with several routes that has apparently loaded into PAN OS 12.1.3 but I cannot view it anymore. I understand Virtual Routers are no longer supported in PAN OS 12.1.3 and an old configuration should be migrated to ARM when a PAN OS Update is performed. But here I did not do a PAN OS Update, I just imported a configuration from an old PAN OS...

Selecting the Network->Virtual Router menu, I just get a busy cursor and nothing loads or shows for several minutes and does also not error out.

So I cannot even delete the virtual router configuration. It seems I need to use ARM but also here I have no option to configure the new router model. Seems I am in a kind of dead lock, not being able to fix the fact, that a non-supported configuration part has been imported into PAN OS 12.1.3 and it also didn't let me edit it...

What can I do? Are there any CLI commands that let me delete the virtual router and start configuring an ARM?

How can I import my old running config into the new PAN for migration?

Re: Migration problem from PA220 to PA540 - Virtual Router

daubsi — Sun, 08 Feb 2026 19:40:58 GMT

I managed to load an old config and get the system back into the vanilla state. Now I also see "Logical routers" in the Network tab. As soon as I old my old config, this vanished and there's only the Virtual Routers, causing all the problems mentioned. Can I somehow except that part of the configuration when importing or how can I solve this issue?

Re: Migration problem from PA220 to PA540 - Virtual Router

daubsi — Sun, 08 Feb 2026 20:23:50 GMT

Read that "patching" configs is something which is done in order to export/import only parts of the configuration. Gave it a try: Exported the vanilla PA540 configuration and compared with the PA220 configuration. Removed the whole virtual router section. Added a logical router section I took from the PA540 configuration. Added "<advanced-routing>yes</advanced-routing> to the exported configuration.

Import works and gives no longer an error 🙂

Still I think the Virtual Router migration script which runs when you manuall activate "Advanced routing" in the settings, should be run when you import an old configuration into PAN OS 12.x.x