topic Re: Installing config on a different model. in General Topics

Installing config on a different model.

cengasser — Wed, 13 Jun 2018 15:06:04 GMT

Hi there.

I have a site with a 3020 (the only reason this site has a 3020 is when the device was bought, everyone thought it would be doing more than it is).

They are in a region that doesn't have 4-hour support, so they wanted a spare. The only thing the 3020 is doing is running a IPSEC tunnel to corp, and handing SIP traffic from 2 internal hosts to two external, but local hosts. Port 1 is configured untrust, and port 2 is configured trust, and that's pretty much it except for management configurations. Max bandwidth on the internet is 20Mbit.

Seemed silly to buy another 3020, so we bought a 220 to be the spare. My question is....

Can I just export the config out of Panorama for the 3020, and import it into the 220 without issue? I've done this for like-2-like devices, but the 3020 has more ports on it. If I recall the configuration doesn't show unconfigured ports, but I don't know what happens after the configuration is committed.

Thanks.

Re: Installing config on a different model.

Remo — Wed, 13 Jun 2018 15:45:14 GMT

Hi @cengasser

With panorama this can be done easily. Is the spare device running or powered off until it would be used?

As these 2 devices should have the same configuration, you can simply add id to the same devicegroup and template(/stack) as the 3020. So if it is only you always commit also to the spare 220 or in case of failure you could export the device state from panorama for the 220.

Re: Installing config on a different model.

hfregoso — Thu, 14 Jun 2018 01:13:45 GMT

Panorama would be na easy way of doing it but the only thing that will not match are ithe interfaces. Make sure you make the proper adjustments to the exisiten zones, interfaces, and routes. After doing this all should be smooth. Try to use the same OS.

Re: Installing config on a different model.

Remo — Thu, 14 Jun 2018 11:30:11 GMT

@hfregoso wrote:
Panorama would be na easy way of doing it but the only thing that will not match are ithe interfaces. Make sure you make the proper adjustments to the exisiten zones, interfaces, and routes. After doing this all should be smooth. Try to use the same OS.

If you use the same interfaces you don't have to adjust anything in order to commit the configuration from panorama to the firewalls and if you haven't configured any "new" features the devices don't even need to have the same major versions installed - but in general, the recommended way is to install the same versions.