topic Re: Moving between device groups in General Topics

Moving between device groups

jasonrakers — Thu, 14 Jan 2016 13:59:02 GMT

I am looking to move my firewalls from one Panorama (7.0.3) device group to a new device group. All active policy rules have been cloned over to the new device group from the existing device group, and the objects are all "shared".

Even though all the rules being installed are the same, and being installed on the same set of firewalls, just under a new device group name. I fear that since there are active NAT rules, and there may be some NAT related issues when the new device group gets applied.

Does any one know of any issues when migrating between device groups?

Re: Moving between device groups

jasonrakers — Mon, 18 Jan 2016 13:24:13 GMT

Here is the response from Palo Alto support -

it is suggested to perform the change during a maintenance window since its wiping and rewriting to the firewall.

Re: Moving between device groups

reaper — Mon, 18 Jan 2016 14:58:25 GMT

Although all objects and policies might be identical, because the firewall is being moved between different device groups the entire previous configuration will get removed and replaced by a new one (replacing the old xml with a new one in essence)

This means all objects will be removed and readded and could be assigned a different 'id' by the idmgr process, causing mismatches in existing sessions (each newly added object, zone, rule, ... is assigned an 'id' which is then used by the underlying engines to properly match sessions)

It's recommended to perform this task during a maintenance window to minimise impact

regards

Tom

Re: Moving between device groups

jasonrakers — Mon, 26 Mar 2018 14:55:31 GMT

after moving device groups and commiting the new device group to the firewalls, no noticable impact to traffic was detected.

Re: Moving between device groups

MP18 — Mon, 29 Oct 2018 19:20:41 GMT

I am also planning to do this in coming days.

Seems for you it worked without any issues right?