topic Re: Backup of Virtual Appliance in VM-Series in the Private Cloud

Backup of Virtual Appliance

liewtienqing — Thu, 30 Mar 2023 09:20:00 GMT

Hi PA forums,

I had a question, is it recommended or wise to backup a VM series PA?

Thanks.

(tried googling, but kept giving me virtual backup appliances results)

Re: Backup of Virtual Appliance

Raido_Rattameister — Thu, 30 Mar 2023 12:18:04 GMT

You can export running config from firewall.

If you push config from Panorama then device state is best option as running config export don't include config came from Panorama.

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/firewall-administration/manage-configuration-backups

Although taking snapshots works 99.9% of the time it is not officially supported so can't suggest that.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POL6CAO

Re: Backup of Virtual Appliance

liewtienqing — Fri, 31 Mar 2023 07:24:06 GMT

thanks Raido.. it is a PA firewall though, not Panorama.

And the backup solutions is like VM backup, not snapshots.

Is it still not recommended?

Re: Backup of Virtual Appliance

Raido_Rattameister — Fri, 31 Mar 2023 12:14:00 GMT

Although it says Panorama in the header there is answer part that states "Do not use the VMware snapshots functionality with any PAN virtual machine as it is NOT supported."

It is also mentioned here:

https://docs.paloaltonetworks.com/vm-series/11-0/vm-series-deployment/set-up-a-vm-series-firewall-on-an-esxi-server/vm-series-on-esxi-system-requirements-and-limitations/vm-series-on-esxi-system-limitations

Do not use the VMware snapshots functionality on the VM-Series on ESXi. Snapshots can impact performance and result in intermittent and inconsistent packet loss.See the VMware best practice recommendation for using snapshots.

If you need configuration backups, use Panorama, or from the firewall, use
Export named configuration snapshot (Device > Set up > Operations). Using Export named configuration snapshot
exports the firewall’s active configuration (running-config.xml) and allows you to save it to any network location."

Most backup solutions (there are some exceptions) instruct VMware to take snapshot, then copy data over and then instruct VMware to remove snapshot. So you need to check with your backup software what exact procedure they use.

Re: Backup of Virtual Appliance

liewtienqing — Mon, 03 Apr 2023 02:47:00 GMT

OK thanks, I guess the general advice is consistent enough