topic Re: I am migrating a Palo HA pair VM to a new host and I would like to validate the steps if anyone can assist. in VM-Series in the Private Cloud

I am migrating a Palo HA pair VM to a new host and I would like to validate the steps if anyone can assist.

EricMortimer — Tue, 15 Nov 2022 19:44:15 GMT

I have the following steps laid out. Please have someone verify if this is correct or if I have forgotten anything. I am migrating the HA pair to a new host with vMotion.

- We are running vSphere 7.0 (ESXi host migration is 6.5 > 7.0) please confirm if I need to suspend the heartbeat

- I read that I need to select "This guest was moved" to prevent license invalidation - where is this done?

- Suspend active FW to force failover
- Shut down suspended VM
- Migrate over
- Bring up VM on new host
- Unsuspend VM on new host and suspend VM on old host to force failover.
- Migrate over 2nd VM to new host.

Thank every one in advance!

Re: I am migrating a Palo HA pair VM to a new host and I would like to validate the steps if anyone can assist.

MikeMarks — Fri, 31 Mar 2023 13:52:26 GMT

Good morning,

I dont know if you have completed this migration yet but we recently did it ourselves to separate the active/passive VM-300's. You do have to disable the HA connections between the two before you migrate the machines. It states that you can move the machine while it is still running but in our case we were only moving the passive so we powered it down before the move. Once moved we were able to fire it back up and reconnect the HA connection with no issues.

On a side not do not clone the firewall that you are moving as it does not take the product keys' and configuration needed with it. Learned the hard way.

Hope this helps

Re: I am migrating a Palo HA pair VM to a new host and I would like to validate the steps if anyone can assist.

Raido_Rattameister — Fri, 31 Mar 2023 14:37:55 GMT

What made you decide that HA needs to be disabled?

If you shut down passive for migration then active stays active and HA will sync up again when passive is powered up at new location.

It would only be needed if old host and new host don't have network connectivity.

In this case yes HA needs to be disabled to avoid split brain situation.

Re: I am migrating a Palo HA pair VM to a new host and I would like to validate the steps if anyone can assist.

MikeMarks — Fri, 31 Mar 2023 16:16:31 GMT

It was just as a precaution my company wished to take when dealing with any movement or upgrades to the firewalls that's all. I know it would pick right back up if left on and once we powered the passive back up, we turned HA back on.