Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
@afalfaro wrote:
cordial greetings
The question is, how do you download the config from the 220 and import it to the 440, bearing in mind that the 220 is managed by panorama. That is, I tried to do what you mention to load the config, but it happens that if I do it from the 220 the xml file, brings me only a few lines of configuration (mgmt interface information) does not bring all the configuration, because its administration is given from Panorama. Now, I tried to download a file from panorama selecting only and exclusively the DG and the template, as shown in the attached image, but when I read the xml file in a notepad, I see that there are all the configurations, including those of the other templates and DGs of the other teams, I do not know if I need something when I download it just to have the configuration of the team.Regarding the error, unfortunately I did not take a screenshot of the errors. Being honest, to migrate that config and the only way I found, was to do it by load config partial, loading all the panorama config file to the FW; however, I raised the question in the forum, because I think there must be a much more practical and simple way, I do not think I should resort to this
Tell me or explain me exactly how you would do it.
I remain attentive
If the device/config is controlled from Panorama then there's no need to export any configuration from the existing device (PA-220) then trying to load that config into a PA440.
Using device groups, templates and template stacks you can have multiple hardware types loaded with the same security policy. There will be/should be unique hardware config based on the device template.
As an example we have 3220 and 3400 hardware types that receive the same security policy configuration. This is achieved by using a specific device template for the corresponding hardware type and associating the hardware platforms to the same "Device Group."
Exporting a config and trying to import one won't create the "managed" relationship of the new PA-440 by panorama.
@afalfaro wrote:
Cordial greetings
Thank you very much for your answer, I think I understood you, however, I ask you, you mention that the devices can have the same policy settings or Devices-Group as they are different models, but the template would have to be different. The question is, if I want the new device to have exactly the same configuration of the Network and Device tab (taking into account that it is a replacement), what should I do? They follow exactly the same ips, interfaces, vlans etc) How would I do to load the same template config to the new device?
What would be the step by step
1. Do I have to duplicate the template that is productive and when I connect the new device I assign it to it?
2. Do I register the new device and have to do all the network and device configurations from scratch? Can't I migrate the existing config to the new FW?
3. What would be the best option considering it is a hardware upgrade, but the configurations are the same?
4. How would you do if you are asked to upgrade the FW of a site, but you have to respect the same configuration, considering that the device is managed by panorama?
The information really is there, you just have to play around with it. A lot of times you can "clone" objects and modify them for a different use case. In this case it's tied to (or can be tied to) templates and template stacks.
Take your existing config, clone it then add the 440 hardware to the new template stack designed for the specific hardware type. You don't necessarily need a unique template for the different hardware, but the port count or type will be vastly different from a 220/440 versus a 5200 for instance. So that's what having the same like hardware in a template/stack is the better approach.
