Migration from Palo Alto Multivsys to single Vsys

[SureshBalaji]

Hi Team,

Is there a we can migrate a PA 5050 multivsys configuration from one appliance and migrate it to two different 3220 appliances. Where Each Vsys from single PA 5050 goes to different 3220 appliance. For instance (Vsys1-PA 5050) should converted to one (PA 3220) and another (Vsys2 -5050) goes to second 3220 appliance.

[nextgenhappines]

@SureshBalaji

It should be straight forward but it will take a bit of time of planning, if each vsys has their own untrust interface and address space, that should be pretty easy.  On the multi vsys one, security, nat polcies, etc are all in set vsys vsysX stazes.  Just need to change from set vsys vsys2 rulebase and update to set rulebase.  You can manually edit in XML (if you are comfortable) or you can do it via the set command set as well.

E

[skumar1]

@SureshBalaji 

One easy way of achieving this if you do have Panorama integration is, use the article below to export 5020 multivsys config to Panorama where each vsys will be segregated to different device-group and template . Then add your new 3220 devices to same panorama and push this configuration to each devices separately. 

Then go to each 3220 device and select disable device group and template in Device>setup>management> panorama configuration , where you can make all Panorama pushed config into local config. 

https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/manage-firewalls/transition-a-firewall...