topic Replacing the FW serial number in Panorama with a new one in General Topics

Replacing the FW serial number in Panorama with a new one

MarcinKrasz — Tue, 03 Sep 2024 08:11:49 GMT

Hi,

What is a reliable way to replace the FW serial number in Panorama?

We had a problem uploading a new license because the FW serial number did not match. Palo Alto TAC solved the problem, but the serial numbers changed, which caused the FW to be disconnected from Panorama.

What should be done to swap the serial numbers so that all rules have new FW serial numbers (not old ones)?

Is it enough to just run the command in Panorama?
> replace device old <old SN#> new <new SN#>

Re: Replacing the FW serial number in Panorama with a new one

TomYoung — Wed, 04 Sep 2024 14:48:01 GMT

Hi @MarcinKrasz ,

Assuming everything is the same on the managed NGFW, then yes. You will need to commit when done.

Thanks,

Tom

Re: Replacing the FW serial number in Panorama with a new one

MarcinKrasz — Fri, 06 Sep 2024 09:03:34 GMT

@TomYoung IIt didn't work at all, apparently the command passed, the new serial number was visible in the target in the policy rules, but after the first push the rules were removed from the firewall and could not be pushed to fw. When we disconnected fw and added it from scratch, we could not connect to Panorama, we had to restart the authentication codes from cli. Also, remove the serial number from the Panorama rules manually, because the commit failed (after successful commit, add it back to the rules). This recovery action from the link above does not work at all.