How to move firewalls between Panoramas

szabo_sandor — Thu, 27 Oct 2022 19:46:51 GMT

All NGFWs within a company are currently managed centrally from a central Panorama. The question is how to move a subsidiary's (business unit's) NGFWs and all related configurations (device groups, templates, template stackss, shared objects, etc.) from this central Panorama to a new Panorama installed locally at the subsidiary? We couldn't find a description for this use case, what are the steps to move some firewalls from one Panorama to another so that the moved firewall's operation is not interrupted and they can be managed from the new Panorama after the move?

Re: How to move firewalls between Panoramas

TomYoung — Fri, 28 Oct 2022 00:40:35 GMT

Hi @szabo_sandor ,

You mentioned moving "all related configurations". So, I assume there is no configuration on the new Panorama. In that case, you would remove the NGFW from Panorama following this document -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cmd6CAC being very sure to check the boxes to import the configurations locally. You then have a locally managed NGFW.

The next step would be to follow this doc -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloRCAS to import your locally managed NGFW to Panorama. Be very sure to follow step 5 and use the Panorama > Setup > Operations process to push the initial config to the device after import. This step actually deletes the local policies and objects on the NGFW so that you do not get conflict errors. Do not use the Commit menu until afterwards.

One step that is not in the 2nd doc is that is you want the Template values (Network and Device configuration) to be managed by Panorama you need to select Force Template Values when you do your 1st Commit and Push (or Commit to Panorama and Push to Devices). Then all your policies, objects, network, and device configuration will be managed from Panorama.

Thanks,

Tom

topic How to move firewalls between Panoramas in Panorama Discussions

How to move firewalls between Panoramas

Re: How to move firewalls between Panoramas