topic Re: Paloalto PAN OS7.1.6 to PA 3250 8.1.13 migration in General Topics

Paloalto PAN OS7.1.6 to PA 3250 8.1.13 migration

JyotiPrakash — Wed, 20 May 2020 17:47:36 GMT

Hi,

I would like to migrate one PA 4020 EOL device which is on PAN-OS 7.1.8 and I got one new PA 3250 with 8.1.13 PAN-OS. Can someone please suggest how I can do this migration?

I appreciate your time and help.

Re: Paloalto PAN OS7.1.6 to PA 3250 8.1.13 migration

JyotiPrakash — Thu, 21 May 2020 20:53:39 GMT

Hi Team,

Please help!!

Re: Paloalto PAN OS7.1.6 to PA 3250 8.1.13 migration

OtakarKlier — Thu, 21 May 2020 21:28:13 GMT

Hello,

Its best if both PAN's are on the same version. That way you can just copy the config over using export xml. Or if the config is a mess, you can start over with a new config from scratch.

Regards,

Re: Paloalto PAN OS7.1.6 to PA 3250 8.1.13 migration

JyotiPrakash — Wed, 27 May 2020 18:46:43 GMT

Thank you. Can I try to load the config on new PA-3250 if that can take the config from 7.1.6.8?

Re: Paloalto PAN OS7.1.6 to PA 3250 8.1.13 migration

BPry — Wed, 27 May 2020 22:58:02 GMT

@JyotiPrakash,

You could try but even if you can get it to load it wouldn't pass validation properly and you'll need to correct all of the errors. In a situation like this I would take the chance to go through the config and just rebuild it, migrating over objects so you don't have to go through and rebuild them.

Re: Paloalto PAN OS7.1.6 to PA 3250 8.1.13 migration

JyotiPrakash — Thu, 28 May 2020 09:31:09 GMT

Thank you so much for your help. I will give it a try to load and fix all the error that may occur during the validation. I hope once the commit is successful that may work in production as well?

Re: Paloalto PAN OS7.1.6 to PA 3250 8.1.13 migration

JyotiPrakash — Thu, 09 Jul 2020 15:18:21 GMT

Hi,

I did a config Export from my production PA4020 and load it on PA3250 and got an error for only HA interfaces. I have fixed the HA interface error and commit and it went well. So can I go-ahead to replace the firewall now or will that be any problem?

Re: Paloalto PAN OS7.1.6 to PA 3250 8.1.13 migration

OtakarKlier — Thu, 09 Jul 2020 15:38:58 GMT

Hello,

I would say yes. Obviously do it during a maintenance window and replace one at a time. Perhaps do a side by side comparison of hte two device configs just to make sure the policies and configs are same/similar.

Regards,

Re: Paloalto PAN OS7.1.6 to PA 3250 8.1.13 migration

JyotiPrakash — Mon, 13 Jul 2020 16:55:57 GMT

Thank you so much for the help and support from all of of you. This old 4020 has only Firewall, NAT and OSPF routing config and has been successfully loaded to PA3250 without any error. I have validated the policy, objects, NAT etc and everything just match with existing PA4020.

Kindly let me know if there is anything I need to check before I plan this migration. Also, I have my new PA3250 on PANOS 8.1.3h as per TAC recommended version.