topic Questions about Migrating HA Firewalls to Panorama in General Topics

Questions about Migrating HA Firewalls to Panorama

myamane — Mon, 26 Apr 2021 22:57:52 GMT

I'm working through the documentation to migrate a active/passive HA pair of 3220's to Panorama management and had a few questions (https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management.html).

1) Before I push the configs to the firewalls, what can I check to make sure I don't accidentally overwrite the management IPs of the firewalls and break connectivity?

2) At Step 6.6, if I don't want to use template variables to configure the HA settings and just want to keep that stuff local, what do I do?

3) At Step 6.7 when it comes time to push the device group and template stack configs to the firewalls it says to first push to the Passive firewall, but the steps aren't so clear. For 6.7.1, when it says to Edit Selections do I only select the passive firewall and then continue through to 6.7.4 where the configuration is pushed? And then 6.7.5 fails over to the passive firewall with it's newly pushed configuration. And then repeat steps 6.7.1-4 where I Edit the Selection and now select the Old Active (now passive) firewall and push the config to that one?

Any help is appreciated, thanks in advance!

Re: Questions about Migrating HA Firewalls to Panorama

reaper — Tue, 27 Apr 2021 12:50:29 GMT

for your 1: if you push configuration from panorama to an already configured firewall, the firewall local config will not be changed. instead a little 'override' icon will appear next to the value.

if you click the override to restore it, the panorama values will be added to the fields and you can visually doublecheck if any mistakes were made and then click ok to accept the panorama config, or cancel to revert to device local config.

make sure you did not enable 'force template values' as else you will force panorama values onto previously configured local config, and select Merge with candidate config. (so do NOT enable force template as instructed in 7.2)

2. anything you don't want to include in templates, don't configure in templates. anything you don't configure will be determined by local configuration (or absence thereof)

3. that sounds about right. do steps 1-6 (in edit selection, only check the box next to the secondary device), then repeat steps 1-4 (but now select the primary)

Re: Questions about Migrating HA Firewalls to Panorama

myamane — Tue, 27 Apr 2021 20:44:09 GMT

Thanks for the quick reply. So I shouldn't check the "force template values" box in step 7.2 and then afterwards where I want to use the Panorama template values I can use the Override feature wherever I want?

If for instance I didn't have a setting configured in the template, and then pushed the config with "force template values" selected, then would the local device retain its original setting or would it go to like a default blank state?