Migration from Palo Alto Multivsys to single Vsys

Reply
Highlighted
L0 Member

Migration from Palo Alto Multivsys to single Vsys

Hi Team,

Is there a we can migrate a PA 5050 multivsys configuration from one appliance and migrate it to two different 3220 appliances. Where Each Vsys from single PA 5050 goes to different 3220 appliance. For instance (Vsys1-PA 5050) should converted to one (PA 3220) and another (Vsys2 -5050) goes to second 3220 appliance.

 

Highlighted
L4 Transporter

Re: Migration from Palo Alto Multivsys to single Vsys

@SureshBalaji

 

It should be straight forward but it will take a bit of time of planning, if each vsys has their own untrust interface and address space, that should be pretty easy.  On the multi vsys one, security, nat polcies, etc are all in set vsys vsysX stazes.  Just need to change from set vsys vsys2 rulebase and update to set rulebase.  You can manually edit in XML (if you are comfortable) or you can do it via the set command set as well.

 

E

 

 

Highlighted
L2 Linker

Re: Migration from Palo Alto Multivsys to single Vsys

@SureshBalaji 

 

One easy way of achieving this if you do have Panorama integration is, use the article below to export 5020 multivsys config to Panorama where each vsys will be segregated to different device-group and template . Then add your new 3220 devices to same panorama and push this configuration to each devices separately. 

Then go to each 3220 device and select disable device group and template in Device>setup>management> panorama configuration , where you can make all Panorama pushed config into local config. 

https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/manage-firewalls/transition-a-firewall...

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!