topic Re: Migrating from PA 500 to PA 820 in General Topics

Migrating from PA 500 to PA 820

shubhamG — Fri, 27 Nov 2020 14:00:36 GMT

Hi team

Can we directly take backup of PA 500 running PA OS 8.1 to PA 820 running PAN OS 9.0.

Thanks in advance.

Re: Migrating from PA 500 to PA 820

BPry — Fri, 27 Nov 2020 16:40:52 GMT

You'll be able to load the old configuration and just validate the configuration to check for any errors; on a PA-500 to PA-820 migration I wouldn't expect to see anything major. The biggest thing that you have to look out for is interfaces since the PA-820 only has 4 copper ports and 8 SFP. You'll want to make sure that you take that into account for your migration planning.

Re: Migrating from PA 500 to PA 820

Parker4215 — Mon, 30 Nov 2020 07:19:48 GMT

Thanks for the solution you give keep helping people like this

Re: Migrating from PA 500 to PA 820

shubhamG — Tue, 01 Dec 2020 10:21:36 GMT

Hi @BPry

Thanks for your quick response.

Just wanted to say would there wont be any impact while importing backup from PAN OS 8.1. to PAN OS 9.0..as we know lots of stuff has changed in PAN OS 9.0.

Also if a PA came with factory default with PAN OS 9.0..can we downgrade it to PAN OS 8.1 smoothly?

Thanks again

Re: Migrating from PA 500 to PA 820

OtakarKlier — Thu, 28 Oct 2021 20:45:33 GMT

Hello,

You should be able to import the code. I wouldnt try the downgrade.

Regards,

Re: Migrating from PA 500 to PA 820

oursainsburys — Wed, 03 Nov 2021 02:50:01 GMT

I will be upgrading a High Availability pair of PA-500s to PA-820s in the next few weeks and have started doing my homework on the cutover.

I have learned that the new firewalls will need to be on the same OS build as the old ones & all security updates should match as well. After opening a ticket with PA Support they replied . You should be able to export the device state from the existing firewall and upload it into the new one fairly seamlessly. That was about all that I could get out of them.

oursainsburys

Re: Migrating from PA 500 to PA 820

DDmchk — Tue, 02 Nov 2021 08:04:16 GMT

I've had experience in downgrade of 9.x to 8.1 and it would works for you on empty new firewall (or after factory reset) or in case you have config from same HW for the downgraded PanOS.

so in your case my actions would be

1) get PA-820 at same PanOS level (downgrade) on empty FW

2) save and export of PA-820 empty config
2) get copy of running config from PA-500and try to import to new FW. If fails, then edit the config accordingly on WebUI or if you will met the major issues, get offline and edit config for the parts it failing (normally it is interface mismatch),then import updated config and commit.