PANOS 8.1 to PANOS 10.2 migration using expedition

[matthias.fremont]

Hello

I have an old PA5050, running PANOS 8.1.24.

I need to replace it with a new PA3410 running PANOS10.2

I trying to find the best way to migrate my configuration from my PA5050 to my new PA3410.

Can expedition can help me to do that ?

Any other idea ?

Thanks

[dpuigdomenec]

Hi @matthias.fremont 

Thanks for reaching out.

Expedition is intended to be used when migrating from a 3rd party vendor to Palo Alto Networks.

Given your use case the simplest path is to export your running configuration from your old device and import into your new one.

By executing this action the new device will migrate automatically the running configuration. Maybe is required you reenter shared keys for your VPN configuration using the GUI due to PANOS latest versions are not expecting the keys in plain text. 

Another option, if possible, is to upgrade the old device to PANOS 10.2 and then export the upgraded configuration, in the below link you have information on how to do that: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan...

Hope this helps,

Best regards,

David 

[SteveKrall]

This is what I would try first.  Disable HA on one firewall and save the candidate config as a named xml file.  Do not commit the change. Revert to running after you have the config file. Export the file and open in a text editor like Notepad++.  You will see in the first 5 lines of code a reference to your 8.1.x  version of code.  Change this to 10.2.0 and save the file.  Then import the file to the new hardware, load named config and commit. Then configure HA manually.  Palo changed the naming convention for HA ports so your PA-5000 will reference interfaces that do not exist on a PA-3400 and commit will fail.   One other option is the cli command "load config partial".  But editing the version number in the xml is the easiest and fastest method.

[campocaceres]

Hi @matthias.fremont,

Were you successful in getting this going?  Did you follow @SteveKrall's recommendations?   I'm getting ready to do a very similar migration, and curious how your experience went and if you have any other caveats.