Hardware refreshment from 3020 to 3410 managed by panorama

[Nileshapatil]

Hi All,

Can someone please help me with migration guide or steps old firewalls are managed by Panorama.

Hardware refreshment from 3020 to 3410 managed by panorama.

[OtakarKlier]

Hello,

Should be a fairly straight forward process.

First setup the 3410 management interface:

1. Connect to the console port using Putty
2. Configure the management port
   1. configure
   2. set deviceconfig system ip-address <IP address> netmask <subnet mask> default-gateway <gateway>
   3. set deviceconfig system dns-setting servers primary <IP of internal DNS server if no internal DNS server use 208.67.220.220 >
   4. set deviceconfig system ntp-servers primary-ntp-server ntp-server-address <IP of NTP server or use us.pool.ntp.org>
   5. Commit
3. Log into the GUI
   1. Devices -> License
   2. Retrieve from server

1. Dynamic updates
   • .App Threat 
     • Click the Check Now on the bottom to refresh the version etc.
     • download and install the newest version
   • AntiVirus
     • Click the Check Now on the bottom to refresh the version etc.
     • download and install the newest version

Connect it to the Panorama. If you have any local only configurations, you just need to recreate them on the 3410.

This is the High overview of what to do. There maybe errors and warnings once you try and commit the configuration, just work through them one at a time.

IN A MAINTENANCE WINDOW THAT HAS BEEN APPROVED BY MANAGMENT FOR DOWNTIME.

Once you are ready for the swap, make sure the 3410 is mounted next to the 3020 and move the cables one at a time. 

Check for operation via logs and test etc. Your fall back is to move the cables back to the 3020.

Hope this helps.

[Nileshapatil]

@OtakarKlier thank for the detailed steps. Do you mean once initial configuration is done and new firewalls added to Panorama. Do I need to add those in device group and template where existing 3020 firewalls are lying to replicate the configuration.

[OtakarKlier]

Hello,

"Do I need to add those in device group and template where existing 3020 firewalls are lying to replicate the configuration."

Yes you are correct. This way the new 3410 will get the same policies etc. The one thing you need to ensure is the port configurations are correct etc. Hence the need for a check prior to performing the swap. There are differences in code version from what the 3020 and the 3410 are running and the newer one has more features you might want to explore, etc.

Patience is your friend in this scenario. The last thing you want is to go into the change phase and has a lot of surprises to deal with. The more time you take and check the config on the 3410, the easier the swap will be.

Cheers!

[Nileshapatil]

Ok thanks, Will update you once we attempted the swap

[Brandon_Wertz]

---

@Nileshapatil wrote:

Ok thanks, Will update you once we attempted the swap

---

I want to clarify something @OtakarKlier mentioned. IMO, you do NOT want to move the cables one at a time.  Doing so will likely split an active port-channel leaving 1 cable behind connected to the 3020 you're replacing (Which means both the 3020 and the 3410 will be active creating a split-brain scenario):

I'm currently going through a hardware swap of 3410s for 3220s.  To accomplish this we're taking the passive 3220 offline.  Then when ready taking all active connections away from the "active" 3220 and moving them to the corresponding 3410 all at once.  Doing this will create a brief outage for the service provided for the 3020/3220, but it's the cleanest and quickest way.

There might be a scenario where you can move a cable one at a time from the hardware being replaced by new, but that will involve a lot more detail than a high-level plan any of us have shared here.