migrating config from 7.0.12 to 8.x.x

[TommieVanHove]

hello.

we have a replacement of a palo alto coming up.

the actual migration is I believe from a 3050 model running pan-os 7.0.12

and the config needs to be migrated to a pa 5220 (whic I believe can't run pan-os 7.x but comes with 8.0.0 minimum.

due to security reasons I'm not able to take teh existing config. install it on a lab devic, upgrade that device to get a decent 8.x config.
and upgrading the production device to 8.x first is also not an option.

is there another way to get the config to a 8.x? as just export, import of config will nog work is not recommended.

I read about the migration tool. however:

version 3.3 does not support pan-os 8 currently. (but I read someone using a 7.1 config from teh tool which would load on a 8.0.0 device.

I am running the tool on a vmware player to test. however I can upload a config. and then download that again. but I can't seem to find (nor in guide) where I can configure it that i upload a 7.0.13 config. and download a 7.1.0 config from it. so I'm missing that part of information/knowledge.

any ideas?

[Brandon_Wertz · Accepted solution]

A 52XX series platform only runs 8.X.X code or higher.

I would suggest 2 options.


1. Upgrade your 3050 to the 8.0.X code you plan to run on the 5220. Then import the 8.0.X running config from your 3050 into your 5220. This will give you some errors but you can work through them. (interface assignments and what not.). I think this is the better option because you'll be running the new code on known hardware and you can ensure you don't change code and hardware then potentially have to figure out which could be causing you an issue.

2. Would be to just take your existing 7.0.12 config of your 3050 and load it into your 5220 running 8.0.X code. I actually did this on a 5060 to 5220 swap. Prior to the import I modified the interface assessment in the XML prior to the import then worked through any errors that came up.

[TommieVanHove]

Hello.

thank you for the info.

as stated upgrading was not an option so I had to go with option 2.
however the info I got for this was incorrect as the customer was running 7.1.x not 7.0.

for what it's worth. going from 7.1 to 8.0.13 the only errors I got were related to HA interfaces.

pa5220 has dedicated ha1-a and ha1-b interfaces for ha1. so I had to remove the old (dedicated port for ha1 configuration)

same with ha2 --> had to manually define a new port to be ha2 as pa5220 standard uses a HSCI slot for ha2.
once I had corrected those 2 minor issues I got no more errors/warnings during commit.
so all in all a lot less hassle then what I was expecting to get.

[JyotiPrakash]

Hi,

I want to migrate one PA Cluster from 5020 7.1.16 to 5220 8.1.8. Could you please help me with the steps to follow for this migration and is there a document available?

Thanks

JP

[TommieVanHove]

the marked as solution basically tells you what to do. 

it is preferred that you upgrade your existing hardware to version 8.0 (or 8.1) and then copy that config to the new model running the same version. 

but if that is not an option you can try migrating it as is and work through the various errors you get( mostly easy to understand error descriptions)

I would recommend only 1 version difference though. 
so if your existing config is 7.1.x I would install version 8.0.x on the new unit first. and once the config is succesfully installed on the new hardware upgrade to 8.1.x (as 8.0 is only supported until oktober this year I believe)

as for documentation what to do: well you can follow the normal documents for migrating config between 2 hardware. but need to account for some possible additional errors as your config is also jumping up on OS release. 

step by step procedure I can't give as I suspect the errors can/will very from config to config. 

[JyotiPrakash]

Thank you very much for the detailed information and very much appreciated. I will follow the steps you have mentioned.