Migration Issue from PA-3020 (No-HA) to PA-3220 with HA-Active/Active

[JamesChim]

Hi Brothers,

Existing PA-3020 (PAN-OS 7.1.7) and New PA-3220 with HA-Active/Active (PAN-OS 9.1.x)

How to Migration the Configuration to new device?

1. Just backup the 3020 config and restore the config from PA-3220?

2. Any Migration Tools convert?

** the Existing Device NOT Accept Firmware Upgrade, Due to the Next Phase the PA-500 not support PAN-OS 9.x **

Next Phase, we need to change the PA-500 (PAN-OS 7.1.7) to PA-820 with HA-Active/Active (PAN-OS 9.1.x)

Any Good Solution can easily upgrade?

Thanks, JC

[Chacko42 · Accepted solution]

Hi James,

you need the same firmware version, for doing the export/import migration.

3020 should be good, running the latest 8.1 release, so can you downgrade the 3220 to 8.1 to have a matching configuration.

In addtion or as an alternative, you can install the expedition appliance to do the config-migration and merge your configuration to the new 3220.

Please clarify the PA-500 situation - this one needs to be migrated as well to the 3220 or what's the issue there?

[JamesChim]

Hi Chacko42,

The PA-500 also need Migration to PA-820 with Active/Active HA,

I think the expedition appliance to convert the configuration will be the best way.

Thanks, JC

[iqor_security]

I think you need to build a PA820 FW with same version as existing PA500. Once you import a .xml file to PA820 and all setup working fine then upgrade FW with lastest softwares.

I don't think migration tool is good Idea here because migration tool is good idea if you have other vendor config to move palo alto.

[raghavendra.badiger]

So does this mean, when we migrate from PA-3020 to PA-3220 we dont need to use Expedition? We can directly import the config file if both PA-3020 and PA-3220 are running on same PAN-OS?