Palo to Palo migration

[AurelioTassone]

Hi all,

I have a few questions regarding doing a palo to palo migration:

- Are there any best practices for doing a Palo to Palo migration via Expedition

- Is there any difference in uploading an palo config xml to migrate as opposed to API call?

- What parts of a palo config are not migrated through expedition? For example I have noticed zone protection profiles don't migrate

[lychiang · Accepted solution]

Hi @AurelioTassone 

Normally, for Palo Alto Networks to Palo Alto Networks migration, you can export the configuration from the old firewall and import and load the configuration to the new firewall. There might be interface renaming needed between different models, you can do a search and replace the interface name in XML file directly.  

In terms of the difference when importing the configuration in Expedition, retrieve it directly through API call if you have a direct connection between the PAN-OS device and Expedition. If not, you can manually export the configuration and upload it.

If the zone protection profile is in your original file, it will be migrated. 

[BenKnorr2 · Accepted solution]

Certificates are another thing that don't exist in Expedition and can't be migrated. For Palo to Palo, I would usually recommend just exporting full xml config and importing into target firewall. Before committing on target firewall, adjust physical devices as needed, especially management and dataplane interfaces. If you have Panorama, even better for the migration since you can leverage device groups and templates. If you need to mix-match stuff in those containers in panorama, expedition is a very helpful tool for that.