topic Re: Syntax for PA3050 and PA3020 in Panorama Discussions

Syntax for PA3050 and PA3020

terence.chan — Wed, 18 Jan 2023 07:32:43 GMT

I would like to check if what are the differences between the syntax of xml configuration for the two models? Particularly for the configuration of the two models to the Panorama server.

Re: Syntax for PA3050 and PA3020

aleksandar.astardzhiev — Wed, 18 Jan 2023 13:06:44 GMT

Hi @terence.chan ,

Can you give some background to your question?

Configuration syntax is heavily depends on the PanOS version, rather than platform you are running. Especially when you are comparing two models from the same series.

If you check the datasheet for PA-3000 series you can see that PA-3050 and PA-3020 actually have exactly the same I/O - https://www.krome.co.uk/wp-content/uploads/2016/06/Palo-Alto-Networks-PA-3000-Series-Datasheet.pdf

The only differences is the maximum performance.

So you plan to swap one for the other it shouldn't make any difference from configuration point of view.

Re: Syntax for PA3050 and PA3020

terence.chan — Thu, 19 Jan 2023 00:53:53 GMT

Hi @aleksandar.astardzhiev ,

I was replacing the PA3020 with a PA3050. There was some issues with the validation when I tried to commit the configurations after importing the device state. It mainly circles around the panorama configurations where the Panorama is setup in HA. Also, the two firewalls (PA3020 and PA3050) are on the same version 8.1.23.

The original PA3020 is not functional and the device state was not managed by me, hence I am not sure if the validation issue is due to the differing version of device state at export, or was it due to the incorrect importing of old configurations by importing from device state.

Re: Syntax for PA3050 and PA3020

aleksandar.astardzhiev — Thu, 19 Jan 2023 22:17:59 GMT

Hi @terence.chan ,

As you can see from the following link importing device state between different model is not officially supported - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaOCAS

I haven't personally tested this, but based on how similar PA-3020 and PA-3050 are I still believe you could get away with it. But again, according to documentation you shouldn't to it that way.

Can you provide more information about the validation error you are receiving? We can try to figure it out.

On other hand - if the firewalls are managed by Panorama, probably it will be better to just:

- Configure basic setup in order to allow PA-3050 to reach and connect Panorama

- Once PA-3050 is onboarded on the Panorama, just assign exect same template stack and device group which were used by the old PA-3020.