topic Re: PA-220 to PA-440 Migration Recommended Process in General Topics

PA-220 to PA-440 Migration Recommended Process

EddieReyes — Thu, 11 Jan 2024 19:42:39 GMT

I need to migrate 2 stand alone PA-220s to PA-440s. The current PA-220s are running PAN-OS 10.2.4-h2.

I would like to know the recommended process for doing this.

Can I backup the configuration and system state and restore it on the PA-440?

Do I use Expedition to migrate the current config to the new firewall?

Thank you in advance

Re: PA-220 to PA-440 Migration Recommended Process

TomYoung — Fri, 12 Jan 2024 04:02:51 GMT

Hi @EddieReyes ,

You can backup and restore the configuration to the PA-440s. I have done it a few times. It works great. Once you load and commit, you can login with the PA-220 admin password. You do not need to use Expedition, especially if your NGFWs are running the same PAN-OS.

You do not have to backup and restore system state, but that will work fine also. Here is a good discussion on the differences between the two.

https://live.paloaltonetworks.com/t5/general-topics/what-s-the-difference-between-each-of-export-backup-options/td-p/162108

Thanks,

Tom

Re: PA-220 to PA-440 Migration Recommended Process

EddieReyes — Tue, 16 Jan 2024 12:51:53 GMT

Thank you, Tom. I appreciate the assist.

Re: PA-220 to PA-440 Migration Recommended Process

EddieReyes — Thu, 08 Feb 2024 18:37:52 GMT

Tom:

I was able to migrate one of the PA-220 to a PA-440 without problems.

The other showed commit failures. One of the failures is because the self signed certificates have a Block Private Key icon next to the Key check. I tried manually exporting and importing the certs, but then i had a commit failure due to the Service Account password used under User ID. Have you ever seen this?

Thanks.
Eddie

Re: PA-220 to PA-440 Migration Recommended Process

TomYoung — Thu, 08 Feb 2024 18:56:04 GMT

Hi @EddieReyes ,

Yes, I have! The master key may be different for the 2 NGFWs, and the new FW cannot decrypt the hash. Open configuration box in the GUI and retype the password. Then commit.

Thanks,

Tom

Re: PA-220 to PA-440 Migration Recommended Process

EddieReyes — Thu, 08 Feb 2024 19:09:50 GMT

Tom:

I am sorry to ask but which master key are we talking about. I don't have a master key configured on either old or new firewall.

Is it under Master Key and Diagnostics? I am not using that.

Thanks.

Eddie

Re: PA-220 to PA-440 Migration Recommended Process

Alejandro_Hernandez — Thu, 08 Feb 2024 19:23:24 GMT

Hi @EddieReyes, could be you have an issue with the certificates for decryption

I recommended to download de device state in Device > setup > operation > export device state and this option export the private key from PA220, and for PA-440 apply the same option, so now you will import the device state and the private key reside in the new firewall, then apply commit

Re: PA-220 to PA-440 Migration Recommended Process

TomYoung — Thu, 08 Feb 2024 19:25:42 GMT

Hi @EddieReyes ,

Sorry that I wasn't clear! Open the GUI configuration for "Service Account password used under User ID" and retype the password.

Yes, Master Key and Diagnostics. The NGFW uses a default master key if it is not configured. You do not need to do anything for it.

Thanks,

Tom

Re: PA-220 to PA-440 Migration Recommended Process

EddieReyes — Thu, 08 Feb 2024 22:10:02 GMT

No apologies needed, Tom. I really appreciate the help. I ended up having to import the SSCerts and provide the UserID account password and preshared keys for S2S tunnels. I was able to commit after that.

Thank you for sharing your expertise. I appreciate it.

Eddie

Re: PA-220 to PA-440 Migration Recommended Process

EddieReyes — Thu, 08 Feb 2024 22:12:57 GMT

Thank you, Alejandro.

I tried exporting and importing the device state, but the commit still failed like before. I tried several times and rebooted in between, but no cigar. I ended up having to import the SSCerts and provide the UserID account password and preshared keys for S2S tunnels. I was able to commit after that.

Like Tom, thank you for sharing your expertise. I appreciate that.

Eddie

Re: PA-220 to PA-440 Migration Recommended Process

jmatanane — Tue, 16 Apr 2024 21:17:54 GMT

I'm not aware of Expedition, is that a separate tool? Also, I'm wondering about how the interfaces will line us since they aren't one-for-one. For example, the 220s have 8 ethernet interfaces 1/2-1/8, but the 445s have 9 interfaces with the mgmt. interface being at 1/1 and the rest from 1/2-1/9.

Thanks for you input!

Re: PA-220 to PA-440 Migration Recommended Process

EddieReyes — Wed, 17 Apr 2024 12:07:08 GMT

Expedition is a Community supported Migration Tool.

I have used it to migrate from 4 ASAs and 1 Sonicwall to Palo Alto Firewalls. Those migrations went really well.

Here is a link if you want to learn more: https://live.paloaltonetworks.com/t5/expedition/ct-p/migration_tool