PA-820 to PA-440 Migration with Expedition

[QTUltrasound]

Migrating from PA-820 SW ver. 10.0.2 to PA-440 SW ver. 10.1.8 and have been instructed to use Expedition.
Is the new FW config used as the Base Configuration in Expedition and the old FW config is the Configuration to Migrate?
Are there migration issues migrating to a newer SW ver?
Are there other considerations I need to make?

The current config is not complex and I will be cleaning up unused items during the migration.

[lychiang]

You don’t need expedition for your use case . Have you tried export the running config from the old device and import and upload it on to the new device ? 

[QTUltrasound]

I have not done that yet. I need confirmation that migration path is not an issue if the FWs have different OS versions.

[gbrown]

Hi there, as per the advice from Lychiang you wouldn't necessarily need to use Expedition for this migration at all.

The export of the PA-820 config should work just fine when importing into the PA-440 series running 10.1, but the safest bet would be to upgrade your current environment to the latest 'preferred' release of 10.1 (10.1.10 - https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-...) and then import into the PA-440 running this version.

This also ensures that the config before/after is 100%, including any difference in behaviour between the 10.0 and 10.1 versions of PAN-OS. When performing the migration, the only element that is changing would be the interface MAC addresses, unless you are running HA when even that would potentially remain the same.

HTH,

Graham

[SaurabhB]

In response to this, if you are unable to upgrade the current version then try your new firewalls with the same version as your 820 FW has. You can upgrade the firewalls at later stage as well.