topic Re: Import PA-500 config on PA-3020? in General Topics

Import PA-500 config on PA-3020?

networkadmin — Mon, 07 Mar 2016 15:30:45 GMT

We have a 500 that we're replacing with a 3020 which arrived today.

Should I need to do anything to migrate the config across other than an export and import of the running config?

I know some things like ports will clearly need addressing but in terms of getting the base config across is there anything I need to be particularly aware of please?

Re: Import PA-500 config on PA-3020?

reaper — Tue, 08 Mar 2016 10:53:58 GMT

you should be able to simply export and import the configuration and be up and running in minutes

one of the few caveats would be if FIPS mode is enabled or the master key has been changed, in which case appropriate steps need to be taken to get the PA-3020 in the same operational mode before moving config, but other than that there should be no issues

Re: Import PA-500 config on PA-3020?

networkadmin — Tue, 08 Mar 2016 18:05:02 GMT

@reaper wrote:

you should be able to simply export and import the configuration and be up and running in minutes

one of the few caveats would be if FIPS mode is enabled or the master key has been changed, in which case appropriate steps need to be taken to get the PA-3020 in the same operational mode before moving config, but other than that there should be no issues

Thanks, had a chat with an SE today who suggested the same, albeit Palo Alto seem very careful to use words like "should" rather than saying it will work.

The rough plan as of now is to setup the new 3020 using the management interface as if it's a brand new unit, so we'll activate licenses and update PANOS to the same as the 500, and ensure we have updates, then I'll pull the config across and see what happens when I hit commit.

Given the interfaces will match up I'm reasonably hopeful it'll go OK, just be nice if there was a bit firmer response from Palo Alto on what is/isn't officially recognised 🙂

Re: Import PA-500 config on PA-3020?

Lucky — Tue, 08 Mar 2016 19:27:19 GMT

Hi Admin,

as you properly noticed, if it is not listed in official documentation "should" is the best you will get 🙂

However, in practice, I have not experienced any major issues and I do import configurations very often (load configs from one device into another, non-matching models, for either a quick look or for replication).

There was a discussion with a bit more detail on hw upgrades and problems, shared here, explaining what might break, why, and what to do in such case.

As 3020 has more interfaces than 500, as long as you match all software updates and content versions, you should not see any problems, I would be suprised if you did. Problems I personally saw were almost always 2k or 4k into something else (as old boxes have more interfaces) or 5k into VM, or when importing multi-vsys configs into single-vsys devices, and I imported...lots of configurations 🙂

If you get stuck, let us know what happened or open a TAC case - you will hopefully have some time to test it and not merely hours/minutes to replace them. In the worst case, you can always open TAC case in advance and submit tech support file from your PA-500 asking TAC to check if they can import it without problems into their lab 3020 device.

Best regards,

Luciano

Re: Import PA-500 config on PA-3020?

networkadmin — Thu, 10 Mar 2016 18:39:27 GMT

Thanks Luciano, so what I did was get both boxes on the same revision of all updates, then as you say simply exported and imported and then committed the config and it took it first time with no complaining or anything.

So right now the new box is sitting in the rack waiting for a window to cut across - seemed remarkably easy 🙂