Panorama managed config conversion from 5200 to 1400

[RChoundry]

Downgrading from 5200s to 1400s, 5200s are centrally managed by Panorama. Any guidance on efficient ways of doing this using expedition and avoid going to locally managed, refresh, and then going back to panorama managed?

[lychiang]

Hi @RChoundry For PAN-OS to PAN-OS migration do not need to use Expedition, please open a case with our TAC, they will be able to assist you. Thank you!

[RChoundry]

Already tried that, TAC works on break-fix only. I was directed at sales team to look for PS engagement.

[ksalustro]

Hi, this is not that hard at all, since you have Pano.

1. Connect the new fw's to Pano.

2. Clone your 5200 template & stack.

3. Edit the new template as needed to adjust interfaces

4. Add the 1400's to the 5200 device group and the 1400 stack.

5. Push the config 

6. After cutover, take the 5200's out of the device group and retire them. Delete the old 5200 stack & template.

[RChoundry · Accepted solution]

Thanks, here's what worked. Same thought, different steps.

1. Connect the new fw's to Pano.

2. Clone your 5200 template & stack.

3. Edit the new template as needed to adjust interfaces

4. Create new device-group, copy config from existing DG to new DG using 'load config partial' commands

Load a Partial Firewall Configuration into Panorama

5. Edit DG (NAT policies) as needed to adjust for ethernet port re-mapping

6. Add new firewalls to new DG

7. Push the config 

8. After cutover, remove 5200s from associated device group and retire them. Delete the old 5200 device-group, stack & template.