topic Re: Configuring an ON-SITE-SPARE in General Topics

Configuring an ON-SITE-SPARE

sabi4evr_com — Mon, 19 Aug 2019 10:58:10 GMT

Dear techs,

Can any one give me some rough idea on how to configure a PA OSS unit?

I have a PA 3020 unit in live infra. Recently bought another 3020 unit. The idea is to replicate all the configurations and settings from live to the OSS unit and keep the same offline.

Any help is much appreciated.

Thanks in advance.

Re: Configuring an ON-SITE-SPARE

reaper — Mon, 19 Aug 2019 12:09:55 GMT

you can download the same PAN-OS and application package you are using on your active device and install it on the OSS, then load the config file you backed-up from the active device

all you'll need to do is fetch the latest threat package the moment the device is put in service, to be up and running

Re: Configuring an ON-SITE-SPARE

sabi4evr_com — Mon, 19 Aug 2019 12:17:38 GMT

Thanks for the update.

Sadly, my account doesnt have the previllage to access the download portal. I am awaiting for the credentials from Manager. Will update once I have the details with me.

While updating the PAN OS I have to install the base version first then, required update\version on top of that. Correct?

Thanks in advance

Re: Configuring an ON-SITE-SPARE

OtakarKlier — Mon, 19 Aug 2019 14:48:04 GMT

Hello,

You just need the base version downloaded to install the dot release. Also if you have 2 3020's why not put them into HA?

Cheers!

Re: Configuring an ON-SITE-SPARE

sabi4evr_com — Wed, 21 Aug 2019 04:08:25 GMT

Dear,

I beleive the client dont want to spend additional amount for purchasing licenses and all. Well i'm not sure though. The task was to setup the device as OSS.

I need few more days to download the required files. Still waiting for the credentials.

Cheers to all.

Thanks for the replies.

Re: Configuring an ON-SITE-SPARE

OtakarKlier — Wed, 21 Aug 2019 15:59:35 GMT

Hello,

Then the best way would be to do as Reaper suggested. Also anytime there is a change to the production unit, save a copy of the config to place onto the OOS.

Regards,

Re: Configuring an ON-SITE-SPARE

sabi4evr_com — Tue, 15 Oct 2019 06:34:09 GMT

Dears,

Was engaged with some other tasks hence couldn't update the device. So, I have the OSS device now. The live PA OS version is 8.1.9-h4. So, I am downloading the below versions of PAN OS to flash it to the OSS unit. PA OS versions flashing in order 8.1.0 > 8.1.9 > 8.1.9-h4. I hope this is the PAN OS hierarchy I have to follow. Please correct me if I am wrong.

Thanks in advance

Re: Configuring an ON-SITE-SPARE

VincentPresogna — Tue, 15 Oct 2019 15:35:54 GMT

You don't need 8.1.9, just 8.1.0 & 8.1.9-h4

Re: Configuring an ON-SITE-SPARE

reaper — Tue, 15 Oct 2019 20:01:37 GMT

@VincentPresogna wrote:

You don't need 8.1.9, just 8.1.0 & 8.1.9-h4

this is correct

Re: Configuring an ON-SITE-SPARE

dkordyban — Fri, 16 Apr 2021 10:44:37 GMT

I have the same question. No replies? I would like to load my production device state on my spare unit then have it offline waiting in case the primary fails. I know I would need to xfer license subscriptions at failure point etc.

When I try to commit imported device state it fails stating no valid threat license.

Re: Configuring an ON-SITE-SPARE

sabi4evr_com — Sun, 18 Apr 2021 05:49:36 GMT

I am not sure on the below. I have never tried to import the device state to the OSS unit as I was afraid that having the same configuration on 2 devices might have some impact on the network. I don't have a test network as well, so I didn't tried. So, far I am just backing up all the device backups on a monthly basis. What I know is that during that a device failure, we will need the PA support assistance in transferring the current PA licenses to the OSS unit.

Re: Configuring an ON-SITE-SPARE

sabi4evr_com — Sun, 18 Apr 2021 05:57:17 GMT

Did you give a try in downloading and import the Threat license from the palo alto customer portal? If not, just give a try.

Try the below methods to download the same.

1. login to customer support

2. Go to assets

3. Select devices

4. Download the Threat Prevention License

I think the OSS should also have all the latest dynamic updates as well.

Re: Configuring an ON-SITE-SPARE

reaper — Sun, 18 Apr 2021 06:48:33 GMT

You can't import the device state as this will require the same subscription licenses, and installed packages, as the production device

An OSS can be kept updated with

-PAN-OS upgrades

-App-ID updates

-imported config files from production device

Upon failure the device can go live immediately and fetch subscription updates as soon as the licences have been moved and retrieved

If your failed device is still up at the time of failure you could export and import a device state at that time, but 'historically' there is no advantage over importing device state versus configuration onto a standby device: device state contains session table and other runtime info that is useless for the purpose of updating an offline spare

Re: Configuring an ON-SITE-SPARE

PatScott — Fri, 29 Oct 2021 16:56:57 GMT

HI @dkordyban - I am currently in the same situation. Did you need to register your cold spare on the support portal incurring licensing costs or could you register the spare in the support portal and have it ready to be moved into production?
I have a cold spare that will import and load the config I exported from my prod PA3050, but it won't allow to commit changes as it's not registered.
It is on same PANOS version as well.

There's a section on the support site that allows one to "Register Spare", but I am still awaiting for support to respond with any associated costs to do that and have it get updates via it's Internet connected MGMT interface.

I am well aware of HA pair, and they might do that, but for now the client wants to have a viable spare to quickly switch to in event of emergency hardware failure to avoid RMA turn around time with supply chain issues we are facing.

Any input for having a spare ready to replace the Production appliance is welcome and very much appreciated!

Re: Configuring an ON-SITE-SPARE

dkordyban — Sun, 31 Oct 2021 12:09:08 GMT

Hi PatScott

We have 2 PA-5220 firewalls. One is fully licensed with AV,URL,Support. The other is setup as on site spare in assets.

Must go through support.paloaltonetworks.com to transfer licenses to spare in the case of primary hardware failure.

How to Transfer Licenses to a Spare Device - Knowledge Base - Palo Alto Networks

Periodically, as configuration changes and Pan-OS gets upgraded on primary unit those changes should be mirrored and config exported/imported.

Re: Configuring an ON-SITE-SPARE

PatScott — Sun, 31 Oct 2021 13:47:54 GMT

Thanks, @dkordyban - I finally found that link. Really appreciate the reply. I want to go ahead and register our spare PA3050 in the assets section of the support portal. I just wasn't sure if I could register it as spare in assets and just leave it there in the spares pool waiting and ready to transfer the license in event of hardware failure with our production PA3050.

I'm assuming you connected your spare's MGMT interface in the same rack and sub-net as the Production 5220 so you can manage it there and have it ready to go?

That's my plan for now, but waiting for Palo Alto support to reply after nearly 7 days is getting old and I want to register the spare PA3050 as spare as soon as we can.

Thanks for any assist and any further insight.

Pat

Re: Configuring an ON-SITE-SPARE

TomYoung — Sun, 31 Oct 2021 18:52:53 GMT

Hi @dkordyban ,

If you remove the AV, AS, VP, and WF security profiles from your security rules, you will not get the error or warning. The easiest way to do this is to use security profile groups in your security rules. You can remove the profiles once without touching every rule. Then you can easily add them back after you have transferred the license.

Thanks,

Tom

Re: Configuring an ON-SITE-SPARE

sabi4evr_com — Thu, 16 Dec 2021 06:54:25 GMT

Yes, it happened. The primary PA FW was crashed and we couldn't recover. We had a huge network outage, it all happened with a faulty network switch which continuously sends the topology change packets to the entire network resulting in a network loop. At some point the FW was not responding, did a reboot after the backup. It never came back, the status lights were off except the power light. Even nothing from the console port as well, no messages or boot information showed up.

Luckily we had the PA OSS device. This is what we did.

1. Raised a case with the support at the highest priority
2. We powered on the OSS device and confirmed the PAN OS version
3. There was a version difference between these 2 devices
4. Downloaded the base PAN OS and the updates to match the version of PAN OSS to the live unit
5. With the help of mgmt port, updated the OS of OSS unit
6. Restored latest backup to the OSS unit
7. We did received some errors during the restoration, I believe those were some Firewall security rules, which
was easy to troubleshoot
8. The support guys came into the scenario
9. For some reason, the OSS unit was not showing in device list. May be it wasn't added during the time of purchase
10. They added the unit with the SN # information
9. Downloaded the latest AV, URL, GP, Clientless VPN and other licenses from the portal and restored to the OSS unit
10. Removed the existing license information of faulty unit from the Portal
11. Assigned the license to the OSS unit and renamed the Unit to Production one
12. All services were restored
13. RMA was issued, but it took 2 weeks or so
14. The core team was unable to analyze the firewall as it was completely given up

The overall process might have taken 2-3 hours. As we were doing this for the first time on working hours it was a difficult one. Having the support engineer on the right time saved us a big time or else we could have spend more hours figuring out on how to transfer the licenses.

Re: Configuring an ON-SITE-SPARE

PatScott — Thu, 16 Dec 2021 09:50:15 GMT

@sabi4evr - Can I ask what level support you had? 2 Weeks seems like a long time. Our support contract is indicated as 4 hour premium support. Sorry for your troubles and glad it finally worked out for you.