Panorama M500 to M700 Migration with Prisma Access

AceTeamSecurity — Wed, 24 Apr 2024 03:46:12 GMT

Hi all,

We are planning to perform a Panorama M500 to M700 migration with Prisma Access VPN Users integrated in. What would be the best steps to do to achieve minimum downtime for the VPN Users.

For context, we are to migrate Prisma Access & CDL license from M500 to M700. However, by doing this, we understand that there will be downtime for VPN users during the transfer process. Let's say that we are to purchase another license for M700 just for the migration, what would be the risks and would it be a advisable step?

Appreciate your response.

Re: Panorama M500 to M700 Migration with Prisma Access

husingh — Fri, 03 May 2024 21:11:31 GMT

Hi @AceTeamSecurity Actually, there wouldn't be any downtime. Panorama is only the management portion, all of the data plane would be active during the upgrade/transfer.

Unfortunately, that below document does not say anything about downtime. But you should perform this operation during a maintenance window, regardless.

https://docs.paloaltonetworks.com/prisma/prisma-access/3-2/prisma-access-panorama-admin/l[…]grade-prisma-access-licenses-between-panorama-appliances

Documentation for compatibility matrix.

https://docs.paloaltonetworks.com/compatibility-matrix/supported-os-releases-by-model/palo-alto-networks-appliances#id4b1915f8-72c2-4fe5-a791-4899d3867f38

You can also use Panorama admin guide for more information.

https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/transition-to-a-different-panorama-model/migrate-from-an-m-100-or-m-500-appliance-to-an-m-200-or-m-600-appliance

The above document are related to the migration of different Panorama models than what you are asking, however concept is still the same.

topic Re: Panorama M500 to M700 Migration with Prisma Access in Prisma Access Discussions

Panorama M500 to M700 Migration with Prisma Access

Re: Panorama M500 to M700 Migration with Prisma Access