topic Re: Fail to migrate Palo HA FW to Panorama Mgmt in Panorama Discussions

Fail to migrate Palo HA FW to Panorama Mgmt

zinkt101 — Fri, 17 Sep 2021 04:30:54 GMT

Hello,

I tried to migrate Palo HA FW to Panorama mgmt as per below guideline link, but fail in step 5.5.

this is the step what I did;

- Clear "Enable Config Sync" on both FW (OK)
- Connect both FW to Panorama (OK)
- Add both FW to Panorama (OK)
- Import config of both FW into Panorama (OK, but show alert icon(indicate "HA: not in operation") device summary)
- Push and commit back to both FW (FAIL , push is OK but commit not successful on local FW)

any suggestion please and let me know if you need more information? thank you.

Panorama Ver : 10.1.0

Palo FW Ver : 9.1.5

Model : PA220

Guideline link

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management.html

Re: Fail to migrate Palo HA FW to Panorama Mgmt

PavelK — Sun, 19 Sep 2021 12:06:40 GMT

Thank you for your post @zinkt101

Would it be possible to provide details of commit fail message? Typically there is description what prevented commit to succeed.

Thank you

Pavel

Re: Fail to migrate Palo HA FW to Panorama Mgmt

zinkt101 — Sun, 19 Sep 2021 12:22:22 GMT

thank you for your response @PavelK

this is the fail error message on local FW

Operation

Commit

Status

Completed

Result

Failed

Details

Validation Error:

deviceconfig -> system -> update-schedule -> wildfire -> recurring -> every-15-mins -> sync-to-peer unexpected here

deviceconfig -> system -> update-schedule -> wildfire -> recurring -> every-15-mins is invalid

Commit failed

Warnings

After this error message, I tried by turning off sync-to-peer on all dynamic updates on both passive/active FW, then re-start migrating to Panorama again.

still show the above error message again.

thank you.

Re: Fail to migrate Palo HA FW to Panorama Mgmt

PavelK — Sun, 19 Sep 2021 20:52:17 GMT

Thank you for reply @zinkt101

Before you start migration, could you set the download schedule of Wildfire to: "None" on both Firewalls, then start with migration over? If it succeed, then after migration you can change Wildfire scheduler from Panorama via Template.

Kind Regards

Pavel

Re: Fail to migrate Palo HA FW to Panorama Mgmt

zinkt101 — Mon, 20 Sep 2021 08:46:18 GMT

hello..

after I tried with schedule of Wildfire to: "None" on both Firewall, still fail with this new error message.

Operation
Commit
Status
Completed
Result
Failed
Details
Validation Error:
import -> network -> logical-router unexpected here
import -> network is invalid
Commit failed
Warnings

Re: Fail to migrate Palo HA FW to Panorama Mgmt

zinkt101 — Tue, 21 Sep 2021 08:19:54 GMT

Hello...

finallyy, it worked well by downgrading Panorama 10.1.0 to 10.0.7.

thank you.

Re: Fail to migrate Palo HA FW to Panorama Mgmt

PavelK — Tue, 21 Sep 2021 08:25:47 GMT

Thank you for sharing @zinkt101

After your last post, I was running out of ideas. It is good that you could eventually solve it by downgrading.

Re: Fail to migrate Palo HA FW to Panorama Mgmt

zinkt101 — Tue, 21 Sep 2021 10:52:58 GMT

yeah. thank you @PavelK

I have another PA HA pair which is running version 8.1.xx to migrate, not sure it will be OK with this panorama version 10.0.7.

Re: Fail to migrate Palo HA FW to Panorama Mgmt

benlewis — Wed, 13 Apr 2022 22:09:46 GMT

Hi @zinkt101 , I had a similar issue recently when attempting to migrate a 3250 HA pair (10.0.8-h4) to Panorama 10.1.3. I was able to complete the push and commit however anything that uses a password or secret such as a IKE Gateway pre-shared key didn't work. The resultant outage was significant with over 100 IPSec VPN's configured so I quickly reverted the 3250's to their original device state.

I suspected someone had set a new Master Key however that wasn't the case. I then compared the encrypted values for passwords and pre-shared keys between firewalls and Panorama and they were indeed different. I know Panorama 10.1.3 doesn't support firewalls running 10.1.0 - 10.1.2 (Panorama Admin Guide) however I can't find official word that 10.0.X isn't supported either.

Downgrading isn't really an option as 10.0 becomes end of life in July this year so next step is trying the process again with an eval VM running 10.0.8-h4 loaded with very similar config to the 3250's and see if the same result occurs. Following on from that I will upgrade Panorama and the VM to 10.1.5-h1 to see if the issue is resolved.

I have another 15 x 440's on Satellite links to migrate so need to make sure the process is error free.