Importing PA200 configuration to PA220.

[Nischal]

We are planning to phase out PA200 firewall with PA220 .

PA200 firewall is running PAN OS 7.1.14.

PA 220 firewall comes preloaded with PAN OS version 8.0.X.

My concerns is, Can we directly import the firewall configuration  (device state) from PA200 to PA220 without any issue? 

Or do we need to upgrade the PA 200 first to 8.0.x and then export and import this config to new PA220?

[kiwi]

Hi @Nischal,

From the Firewall Migration Guide :

Determine the target PAN‐OS release — Before you Migrate to New Firewalls, ensure that the old firewall is running the same PAN‐OS release and the same content release version as is installed on the new firewall. If the old firewall does not support the PAN‐OS release that is installed on the new firewall, you must ensure that the old firewall is no more than one feature release behind.

You can find the entire guide on this page :

https://www.paloaltonetworks.com/documentation/platforms

Cheers !

-Kiwi

[BPry]

@Nischal,

As @kiwi noted these need to be running the same version to properly perform the migration as you are planning. Of course, you could perform this migration without updating if you simply utilize the running-config.xml as a basis of re-creating the configurtation directly on the PA-220 instead of importing it. This would allow a chance to go through the entire configuration and verify that there are not any unneeded statements, as well as giving you a chance to properly test traffic before installing it.