Can Expedition migrate from PA200 to PA440?

[jchen5]

I would like to migrate from PA-200 (with OS 8.1.24) to PA-440 (with OS 10.1.3). Can Expedition migrate from Palo Alto to another model or Expedition can only migrate from other vendors to Palo Alto?

[AbhijeetBhapkar]

For PA to PA migration, does not require an expedition tool, you can easily export the running config as a xml fle from the old PA and import the file back to the new PA . 

[jchen5]

Thank you very much for your feedback. I did try it but failed. The latest OS for PA200 is 8.1.24; however, PA440 cannot downgrade to 8.1.24 OS. Both firewalls don’t have the same OS so when I export the running config as an XML file, it will give you an “Invalid syntaxes” message.
I did try the Expedition tool, it can move address objects and Security policy; however, it cannot move “profile”.

[lychiang]

@jchen5 You could try load config partial command on PAN-OS firewall, it should be able to load partial config from the old config to the new device. 

[MNagel]

What I've generally done for these kinds of migrations is to export the
config in set format, edit interfaces as needed, then apply the result
to the new firewall.  You _may_ run into some syntax changes across
versions, but you can identify them and correct after based on your
session log.

Regards,
Mark

[AbhijeetBhapkar]

As per my understanding, you can use it in 2 ways
1) Need Zone and Interfaces mapping before exporting the XML file in Expedition Tool
2) Take the ssh p200 device and Run the following command to view the configuration:
> set cli config-output-format set
>configure and then execute the show command
3) Capture the view a configuration in "set" format and configure the same on PA440

refer below article for your ref.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHoCAK

[AbhijeetBhapkar]

As per my understanding, you can use it in 2 ways
1) Need Zone and Interfaces mapping before exporting the XML file in Expedition Tool
2) Take the ssh p200 device and Run the following command to view the configuration:
> set cli config-output-format set
>configure and then execute the show command
3) Capture the view a configuration in "set" format and configure the same on PA440

refer below article for your ref.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHoCAK

[AbhijeetBhapkar]

Also, upgrade the hotfix Version 1.2.45 (Date Nov 28, 2022) which resolves the bug

Bug
MT-2512 - AutoZone feature - Security rule zones not properly calculated based on NAT when address object (src/dst) is an IP range

https://live.paloaltonetworks.com/t5/expedition-release-notes/expedition-1-2-45-hotfix-information/t...