topic Re: Migration / Import of configuration only to a destination vsys, a particular vsys in General Topics

Migration / Import of configuration only to a destination vsys, a particular vsys

Metgatz — Tue, 09 Aug 2022 02:23:14 GMT

Migration / Import of configuration only to a destination Vsys, a particular vsys.

Hello good afternoon, as always thank you very much for the support and collaboration as always. Please your your suggestions, advice and / or guidance, how is it possible to perform the import/load config, of a PA configuration, to be loaded only, but only in a vsys( vsys4 ) without touching anything of the rest of vsys of the firewall, just import and load that configuration to the vsys4 ?

Environment/Infra:

PA-5250 Physical Firewall - HA

Vsys1 ready and OK

Vsys2 ready and OK

Vsys3 ready and OK.

Vys4 created, without any configuration, but waiting for the configuration.

Thank you, I remain attentive, best regards

Re: Migration / Import of configuration only to a destination vsys, a particular vsys

BPry — Wed, 10 Aug 2022 02:27:35 GMT

Look into the load config partial command and its various options. Assuming that you are familiar with xpath this is an easy option that doesn't require you to manually modify the configuration file or utilize the Expedition tool. Expedition is the only option that I'm aware of that would let you do this easy enough without required knowledge of XML and the actual configuration file.

Re: Migration / Import of configuration only to a destination vsys, a particular vsys

aleksandar.astardzhiev — Wed, 10 Aug 2022 07:41:16 GMT

Hi @Metgatz ,

I would agree with @BPry and tried to expand a little. I recently used the "load partial config" feature and must say it is fantastic!

There is some nice documentations explaining how to use the command:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/load-configurations/load-a-partial-configuration

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/load-a-partial-firewall-configuration-into-panorama

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClbLCAS

There you can also find instructions how to get the correct xpath for each part of the configuration.

Now let note that "load partial config" can be used only if you have your configuration in XML format. From your post I assume you already have complete FW config in XML format.

I would assume that you want to migrate single firewall as new vsys to existing firewall. In that case I would suggest the following:

- Export running config from the firewall that will be migrated. And save it with different name from "running-config.xml"

- Import that file to the firewall with the VSYSs. Only import it, do not load it. You can do that via the GUI. FW will save this xml and list it under saved configs.

- Using the API browser (explained in the links above) get the xpath for the relevant config you want to import. Depending on what configuration you want to keep and what want to ignore you can use xpaths for specific config only - address, address-groups, security policy rules, etc. Or more generic like all network settings