Activate vsys in FW HA and impact from Panorama

[BigPalo]

Hi,

I have a cluster A/P 5220 model managed from panorama. I would like to activate multivsys capacity and started to configure little by little in a Cluster currently in service. All config is done from panorama.

What would it be the steps and is there any impact (reboot) or whatever. To use maintenance window to do it? if the FW are in HA any particular method?

[BPry]

@BigPalo,

You will want to have a maintenance window since the mismatch state will cause the device to be suspended from an HA aspect, and you'll need to restart the device for the change to take effect. I always prefer to have someone on-site for this sort of maintenance just to ensure that you don't end up with both units thinking they need to be suspended, but you can absolutely do it remotely if needed. 

Everything you already have configured is already technically in the default VSYS ("vsys1") so nothing really happens from a configuration standpoint with what you already have configured. Since you're using Panorama you'll just want to ensure that multivsys is enabled on the template and then you'll be able to assign vsys to the device group. 

[BigPalo]

Thanks Bpry as usual.

I was checking several links and im not sure if i would have to reboot the device: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kFPYCA2&lang=en_US

1) Activate the MULTIVSYS in the template and push only in the passive node.

2) The passive node will enter to "non-functional" state. Do i need to reboot it? If i reboot the device will be in the same "non functional status" since in the active wasnt enabled VSYS yet. how can manage/failover this to not cause impact?

im not sure with the steps.... can you help