Easy way to transfer the configuration of PA-220 to PA-440

[iex2022]

We have two PA-220 firewalls that work in both active and standby mode. Panorama is in control of these two firewalls. We are now attempting to move it to PA-440 because of network issues. Is it possible to transfer the configuration from PA-220 to PA-440 from panorama export configuraiton or can I used expedition to do that? I don't see any documentation. Please review the versions listed below.

PA-220 - Version 9.1.16
PA-440 - Version 10.1.8
Panorama - Version 10.2.3-h2

[PavelK]

Hello @iex2022

thanks for posting.

The target use of expedition is for migration from 3rd party product to Palo Alto. Since these Firewalls are managed by Panorama, the migration should be straight forward. I would suggest below steps:

1.)

Clone Template / Template Stack currently assigned to PA-220 and assign PA-440 to newly cloned Template / Template Stack. If necessary adjust the configuration in Template that is hardware specific to PA-440, for example interfaces.

2.)

Assign PA-440 to the same Device Group as PA-220, then push the Template Stack and Device Group to PA-440.

3.)

If there was no error / issue with pushing the configuration, I would schedule a maintenance window to move cables (or open ports on the switch) from PA-220 to PA-440. Since you mentioned this is a migration with the same configuration, I expect IP addresses assigned to data plane interfaces to be the same, therefore window for cut over might be necessary to avoid IP address duplication.

4.)

If traffic is going through and failover test passed, I would remove PA-220 from Panorama and cleaned up all related configuration.

Regarding versions, there should be no issue. As long as Panorama is running the same version or higher than Firewall.

Kind Regards

Pavel