This Nominated Discussion Article is based on the post "Migrating PA-5050 to PA-5410" by @jjgonza08 and responded to by @Raido_Rattameister. Read on to see the discussion and solution
Is it possible to migrate from PA-5050 to PA-5410? I've been finding threads regarding migrating to PA-5220 only, but nothing on migrating to PA-5410. We've updated the PA-5050 to the final version available PAN-OS 8.1.25, but when we move to the PA-5410 the lowest version possible for it is 10.2.
Will the giant gap between 8.1.25 and 10.2 cause major issues and should I just treat the PA-5410 as a new install? Or should I forget about the PA-5410 and attempt to obtain a PA-5220 as an avenue to eventually install the PA-5410? I'd like to migrate directly to the PA-5410, but I'd like to get input on my options. Thanks in advance for any valuable advice!
Here's a trick you can use:
If you have active support for virtual firewalls you can download the PA-VM OVA from the support portal.
If you don't, then ask the Palo Alto Networks partner company you got the new firewalls from to help with migration or see if they can get you 30 day eval license for PA-VM.
You can export the config out from the PA-5050.
Import the config to PA-VM version with PAN-OS 8.1.x
Upgrade PA-VM version all the way to PAN-OS 10.2.x
Export the config from the PA-VM and import into new PA-5410.
Kiwi,
I was able to configure a VM-50 VMware ESXI from my Support page. I have Perpetual support for the VM, but everything else expired on 09/30/2021. I e-mailed the Sales department regarding the license, but I have not received a response. Once I figure that out, do I need to export both configuration snapshot AND configuration version from the PA-5050 to PA-5410, or just the configuration version? I've been unable to update the VM-50 from 8.1.17 to the next version probably because of the license. I also hope the limitations of the VM-50 will not hinder importing between PA-5050 and PA-5410. Thanks!
v/r
Juan G
@kiwi This is a good idea, and I used it in the past, but it only works for single vsys if simple ethernet interfaces are used. And usually customers with 5xxx series have more complex setups with aggregated interfaces, multiple vsys, etc.
