Configuring an ON-SITE-SPARE

[sabi4evr_com]

Dear techs,

Can any one give me some rough idea on how to configure a PA OSS unit?

I have a PA 3020 unit in live infra. Recently bought another 3020 unit. The idea is to replicate all the configurations and settings from live to the OSS unit and keep the same offline.

Any help is much appreciated.

Thanks in advance. 

[PatScott]

Thanks, @dkordyban  - I finally found that link.  Really appreciate the reply.  I want to go ahead and register our spare PA3050 in the assets section of the support portal.  I just wasn't sure if I could register it as spare in assets and just leave it there in the spares pool waiting and ready to transfer the license in event of hardware failure with our production PA3050.

I'm assuming you connected your spare's MGMT interface in the same rack and sub-net as the Production 5220 so you can manage it there and have it ready to go?

That's my plan for now, but waiting for Palo Alto support to reply after nearly 7 days is getting old and I want to register the spare PA3050 as spare as soon as we can.

Thanks for any assist and any further insight.

Pat

[TomYoung]

Hi @dkordyban ,

If you remove the AV, AS, VP, and WF security profiles from your security rules, you will not get the error or warning.  The easiest way to do this is to use security profile groups in your security rules.  You can remove the profiles once without touching every rule.  Then you can easily add them back after you have transferred the license.

Thanks,

Tom

[sabi4evr_com]

Yes, it happened. The primary PA FW was crashed and we couldn't recover. We had a huge network outage, it all happened with a faulty network switch which continuously sends the topology change packets to the entire network resulting in a network loop. At some point the FW was not responding, did a reboot after the backup. It never came back, the status lights were off except the power light. Even nothing from the console port as well, no messages or boot information showed up.

Luckily we had the PA OSS device. This is what we did.

1. Raised a case with the support at the highest priority
2. We powered on the OSS device and confirmed the PAN OS version
3. There was a version difference between these 2 devices
4. Downloaded the base PAN OS and the updates to match the version of PAN OSS to the live unit
5. With the help of mgmt port, updated the OS of OSS unit
6. Restored latest backup to the OSS unit
7. We did received some errors during the restoration, I believe those were some Firewall security rules, which
was easy to troubleshoot
8. The support guys came into the scenario
9. For some reason, the OSS unit was not showing in device list. May be it wasn't added during the time of purchase
10. They added the unit with the SN # information
9. Downloaded the latest AV, URL, GP, Clientless VPN and other licenses from the portal and restored to the OSS unit
10. Removed the existing license information of faulty unit from the Portal
11. Assigned the license to the OSS unit and renamed the Unit to Production one
12. All services were restored
13. RMA was issued, but it took 2 weeks or so
14. The core team was unable to analyze the firewall as it was completely given up

The overall process might have taken 2-3 hours. As we were doing this for the first time on working hours it was a difficult one. Having the support engineer on the right time saved us a big time or else we could have spend more hours figuring out on how to transfer the licenses. 

[PatScott]

@sabi4evr  - Can I ask what level support you had?  2 Weeks seems like a long time.  Our support contract is indicated as 4 hour premium support.  Sorry for your troubles and glad it finally worked out for you.