PA config replication through Panorama

VarunRao — Thu, 11 Jun 2020 08:16:55 GMT

Hi All,

I am looking for a method to replicate the configuration of one of our virtual firewalls to a physical firewall through Panorama device-groups and templates.

Let me explain the setup:

We have a core firewall with multiple vsys enabled, and one of these vsys is our external (internet) vsys. Now due to capacity issues, we need to replace this external vsys with a physical PA-5260 firewall (different hostname). The configurations would remain the same as in the external vsys and after migration vsys will be shut.

All the firewalls in the environment are manged by Panorama. The current external vsys is part of an existing device-groups and templates. Now I am looking for the best way to replicate the configurations from the current vsys to the phsyical firewall during productions cutover.

Is there a method to copy the security policies, nats, firewall settings from the old vsys to the new firewall through device-group or templates and during prod cutover, shut down the vsys and re-cable to the phsyical firewall and have the same configurations on it?

Any help would be highly appreciated.

Re: PA config replication through Panorama

pawelzwierz — Thu, 25 Jun 2020 12:05:23 GMT

There is a dedicated tool for migrations beetwen PAN and 3rd party vendors - Expedition

Re: PA config replication through Panorama

VarunRao — Mon, 27 Jul 2020 01:52:13 GMT

I am not moving from a different vendor to palo alto. I am moving from a multi-vsys setup to a physical palo alto 5260 firewall.

Re: PA config replication through Panorama

pawelzwierz — Mon, 27 Jul 2020 03:51:36 GMT

Expedition is useful for any migration, between PAN also.

Load partial config can be use as well.

topic Re: PA config replication through Panorama in General Topics

PA config replication through Panorama

Re: PA config replication through Panorama

Re: PA config replication through Panorama

Re: PA config replication through Panorama