PA 5050 & 5060 replacement with PA 5250

Gchander — Fri, 15 Nov 2019 08:46:43 GMT

Dear All,

Can anyone please advise on any specific points to be taken care for a hardware replacements for a pair of firewall 5060 fully managed by Panorama & to be replaced with 5250.

To me a high level plan looks like.

1. Prepare the new firewalls via importing device state with new mgmt ips to avoid any duplicate in network.

2. Test the failovers on the new pair.

3. Add the panorama server ip in the new firewalls.

4. Add the new serial numbers of the new firewalls to the Panorama under managed devices, match the threat & antivirus version, migrate the license?

5. Change the policy target to any in case of if any specific target group was selected.

6. Disconnect the secondary firewall to be replaced & power on the new 5560 unit.

7. Double check the priority on the firewalls to avoid any issues with taking over issues & make it the active.

8.Push the policy on the secondary firewall.

9. Create the device group.

Is there any thing else needs to be taken care? Does anything related to master key is required?

Re: PA 5050 & 5060 replacement with PA 5250

S.Cantwell — Sat, 16 Nov 2019 18:45:23 GMT

Excellent question

Here are steps from the Panorama 220 course.

Configure the management interface of the new firewall.
Review and update the PAN-OS software.
Review and update the dynamic updates.

Use the Palo Alto Networks Customer Support Portal to transfer license assignments from the serial number of the old firewall to the serial number of the new firewall

From the Panorama command line, execute one of the following commands:
> scp export device-state device <old-serial#> to <login> @ <ServerIP>: <path>
> tftp export device-state device <old-serial#> to <login> @ <serverIP>: <path>

To replace the serial number of the old firewall with the new one, execute the following commands:
> replace device old <old-serial#> new <new-serial#>
> configure
# commit

Access the management user interface of the new firewall:
Import the device state.
Perform a commit after the import is complete.

On Panorama:
Select Commit > Commit and Push and Edit Selections in the Push Scope.
Select the Device Groups tab and select the device group that contains the new firewall.
Select Include Device and Network Templates.

topic PA 5050 & 5060 replacement with PA 5250 in General Topics

PA 5050 & 5060 replacement with PA 5250

Re: PA 5050 & 5060 replacement with PA 5250