Firewalls in HA, how bring them in Panorama

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Firewalls in HA, how bring them in Panorama

L2 Linker

Hello I have a HA Active/Passive pair of Firwealls in 7.0.5 and Panorama 7.1.9

I need to import configuration into Panorama. The process below is not clear if I need to do that for both firewalls

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-add-a-locally-managed-firewall-to-pa...

or should I just bring the Active device and the other one I won't need to do that.

That is my assumsion. 

 

any ideas would be appreciated.

 

Thanks

 

1 REPLY 1

L7 Applicator
Hi,

As far as I know this use case involves some manual steps to get it right and cannot be done with a simplr (almost) one click solution like the one you references. I would recommend the following steps:
1. Import the active FW to panorama
2. Clone this template or maybe just create a new one for the device specific setting of the active FW (e.g. mgmt ip,...)
3. Repeat step 2 for the settings of the passive clustermember
4. Create two Template stacks (one for each clustermember) and add the template whitch was created when you imported the active FW to both of the template stacks
5. Add the device specific templates also to their corresponding template stacks
6. If not done already add the serialnumber of the passive FW to panorama
7. Assign the firewalls (serialnumbers) to the created template stacks and also make sure you added both devices to the devicegroup which was created while importing the active firewall
8. Check again your settings in the templates and the device group if everything is correct
9. Commit (without forcing template values)
A) on the active device there should be now problem with the commit because aöl the local configuration is now exactly as it was also in panorama
B) on the passive firewal, acivate the checkbox "Merge with candidate config" when you commit
10. If the commit succeeded, check locally on the firewalls to make sure that the template values are present, but not yet active
11. If everything looks good, do another commit from panorama, this time with the option "Force template values"

Actually these are the steps which I was thinking about. I have not done this yet but I have to migrate a few clusters to panorama in the next two weeks. So if anyone has other tipps or a better solution I would also appreciate it.

Regards,
Remo

PS: The HA Configuration has to stay locally because of some panorama referencing problems (panorama cannot set the HA IP addresses but without them it is not possible to commit the ha configuration to the firewalls)
  • 1564 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!