topic Re: How to Replace a Managed Device (PA-3020) with a New Device (PA-850) in General Topics

How to Replace a Managed Device (PA-3020) with a New Device (PA-850)

big_Gilo — Thu, 10 Aug 2017 15:05:51 GMT

Hi Guys,

I am trying to replace a PA-3020 fierwall with a new Device (PA-850)

could someone maybe give me some Hints with the best Practice?

if the devices were of the same time it would have been pretty straigth-forward according to some docs released by PA.

The old PA-3020 (HA) is managed by panorama so the new device would also be managed by the same Panorama.

i m still trying to figure out just the best way to replace it losing most or any config.

The basics config such as : device registration, retrieving update, etc) have already been done.

This is my idea:

- Export /import Config snapshot, device state, etc. (from the old device to the new device)

- Clone existing template and try to import it to the new device could help. I am not sure whether that will work (3020->850)

are there other stuff i need to consider?

anyone with a better approach ?

i m quite open for new idea.

kind regards,

Gilo

Re: How to Replace a Managed Device (PA-3020) with a New Device (PA-850)

Remo — Thu, 10 Aug 2017 16:29:06 GMT

Do you manage the existing 3020 completery with panorama or only specific settings?

Re: How to Replace a Managed Device (PA-3020) with a New Device (PA-850)

big_Gilo — Thu, 10 Aug 2017 16:45:38 GMT

Hi @Remo : the existing 3020 is completly managed by the panorama

kind regards,

Gilo

Re: How to Replace a Managed Device (PA-3020) with a New Device (PA-850)

Remo — Thu, 10 Aug 2017 16:52:14 GMT

Hi @big_Gilo

Then it should be pretty easy. Simply add the new device to the existing device group and template (stack) and your probably already done. Depending on which interfaces you used on your 3020 you may be have to rearrange them a little. As already suggested you could also clone the device groups and templates and add the firewalls there. If you use the same templates you have to change at least the management IP (if the two devices have to run at the same time).

After you commited the settings to the new one your ready to finish the replacement (shut down the old networkports on your switches and enable the new one for the pa850 to take over.

Re: How to Replace a Managed Device (PA-3020) with a New Device (PA-850)

big_Gilo — Thu, 10 Aug 2017 17:08:45 GMT

Hi @Remo: thanks a lot for your advice.

i will try to clone the existing device groups and template and just add the firewalls there.

that s true i have to rearrange my interfaces as on the 3020 i was using about 12 int but on the new device i m using only 9 int so i have to figure out how to rearrange it.