topic Re: Migration of Panorama configuration in General Topics

Migration of Panorama configuration

bambox — Sun, 27 Feb 2022 17:55:38 GMT

I need to migrate the configuration of a Panorama X to another Panorama Y where I need to split several devices on their own panorama (Y). The plan according to several discussions is to export the config of current panorama X, import into Panorama Y while changing IP address, hostname, etc. This is the step where I am trying to see if it can be done more efficiently, I now plan to change the IP of the Panorama Servers section on the firewall to be the new IP of Panorama Y but my question is, can I for example, set the second field to be Panorama Y IP address, commit the changes, and once I am sure everything is working properly after pushing changes from Panorama Y, I then remove the IP address of Panorama X from the Panorama Servers sections or that could cause issues. Thanks.

Re: Migration of Panorama configuration

PavelK — Wed, 02 Mar 2022 22:13:01 GMT

Thank you for the post @bambox

Exporting configuration from one Panorama and import to new one is from my point of view the easiest way. The only issue you might face is if you try to import configuration to different Panorama model where there are for example different interfaces. In this case, I would just manually edit the configuration file to match target Panorama. Also, I would recommend to have the same PAN-OS version between both Panorama units you are migrating.

For the second part, I am afraid that this will not work. Firewall can be registered only to one Panorama set. For the setting in Firewall under: Device > Setup > Management > Panorama Settings > Panorama Servers, the secondary IP address is for the scenario where Panorama manager is an HA pair. In this case this is where you would configure Panorama standby unit. I do not think you can use this for Panorama migration purpose.

Kind Regards

Pavel

Re: Migration of Panorama configuration

Kuhic567 — Fri, 04 Mar 2022 04:20:22 GMT

@bambox wrote:
I need to migrate the configuration of a Panorama X to another Panorama Y where I need to split several devices on their own panorama (Y). The plan according to several discussions is to export the config of current panorama X, import into Panorama Y while changing IP address, hostname, etc. This is the step where I am trying to see if it can be done more efficiently, I now plan to change the IP of the Panorama Servers section on the firewall to be the new IP of Panorama Y but my question is, can I for example, set the second field to be Panorama Y IP address, commit the changes, and once I am sure everything is working properly after pushing changes from Panorama Y, I then remove the IP address of Panorama X from the Panorama Servers sections or that could cause issues. Thanks. Subarunet.com Login

Legacy mode is no longer supported in PAN-OS 8.1 or later releases. If the old Panorama virtual appliance is in Legacy mode, you must change Panorama to Panorama mode before migrating to the new hypervisor in order to preserve the log settings and Log Collector forwarding configurations. Importing the configuration of the old Panorama in Legacy mode to a new Panorama in Panorama mode causes all log and log forwarding settings to be removed.

Re: Migration of Panorama configuration

bambox — Fri, 04 Mar 2022 23:02:44 GMT

Thank you and everyone for sharing your experience. I managed to migrate the configuration with no issues except that unfortunately the configuration file that PAN documentation mentioned in the process does not usually contain Shared objects which has caused commit issues. For everyone trying to migrate in the future, the only file that contains Shared objects is the one in the config bundle, you have to extract it and get the Panorama xml file which contains all configuration including shared objects.