topic Re: Replacing HA Hardware in General Topics

Replacing HA Hardware

ademo-user25 — Sat, 13 Sep 2025 19:28:02 GMT

Hi All,

I need to replace 3220 in HA to 1420 in HA.

- The 3220 running 11.1.3-h3

- I installed 11.1.3-h3 on the new 1420s.

- Installed the same version of the apps and threats.

- exported the running config from the 3220

- imported the config to the 1420 and ran a commit.

I read that i cannot run the HA with different platforms. Is there a way to do a 0 downtime or only hard cutover to the new HA?

Re: Replacing HA Hardware

PavelK — Sun, 14 Sep 2025 07:14:16 GMT

Hello @ademo-user25

thanks for posting!

To form HA both Firewalls must be the same HW models: Prerequisites for Active/Passive HA.

I have done Data Center Firewall migration before with minimal downtime. Could you please refer to this thread: PALO ALTO 5020 migrate to 5220 from Panorama?

You can skip points No.1 and 2. Also, if you can include more details about your environment it would make it easier and more accurate to answer you.

Kind Regards

Pavel

Re: Replacing HA Hardware

ademo-user25 — Sun, 14 Sep 2025 09:47:19 GMT

Hi @PavelK ,

Thanks for the reply.

We have very simple configuration of 2 firewalls in HA. We want to keep the same configuration, IP etc. just with the new hardware.

No Panorama.

We mounted the new firewalls next to the old firewalls.

I've done it on other firewalls but this is the first time i replace palo alto hardware so i am not sure what behavior to expect.

my plan is:

1. disable preemptive

2. move cables from old firewall2 to new firewall2: i am expecting the firewall to be able to see each other but not be a working HA

3. allow new firewall2 to download and activate license from license center.

3. make new firewall2 active. i am expecting to be able to just click for a failover but will disconnect old firewall1 if not.

4. after sanity tests, move cables from old firewall1 to new firewall1.

5. allow new firewall1 to download and activate license from license center.

6. at this point im expecting to see a healthy ha pair.

7. failover to new firewall1

8. run sanity tests

9. reactivate preemptive.

This way i am hoping to have no downtime during the replacement.

Re: Replacing HA Hardware

PavelK — Mon, 15 Sep 2025 22:56:17 GMT

Hello @ademo-user25

thank you for reply.

To me your approach looks good. If you do not mind setting up new Firewall pair with new management interface IP addresses (The rest of the configuration can be identical with original Firewalls), you could save time during cut over on initial tasks like downloading licenses and forming HA.

Also, you might have to clear ARP records in your Layer 3 switches during cut over to new Firewalls. This scenario would come when GARP does not work to update ARP entries with new IP/MAC mapping.

Kind Regards

Pavel