Migration of HA Pair to Panorama!

[Pradeepkumar064]

Hello Folks,

I'm planning to Migration of HA Pair (active-passive) to Panorama, can someone help to understand whether ther will be a service interruption during this phase?

HA Pair -> 8.1

Panorama -> 8.1

Best Regards,

Pradeepkumar 

[bseal · Accepted solution]

There should not be any service interruption on migration of an existing HA pair into Panorama Management.

Here is the link to the steps to complete the setup: 

https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/manage-firewalls/transition-a-firewall...

Refer to : Migrate a Firewall HA Pair to Panorama Management

Thanks

[Pradeepkumar064]

@bseal 

Thanks for your quick turn-up!

I was going through the link you provided, even though it didn't say explicitly that the migration is non-disruptive, but it does mentioned If we have a pair of firewalls in an HA configuration that you want to manage using Panorama, you have the option to import the configuration local to your firewall HA pair to Panorama without needing to recreate any configurations or policies, is my assumption are correct?

Thanks in advance.

[bseal]

The steps mentioned in the article provides step by step process, where an existing HA-pair configuration ( config-local to the firewall) is migrated to the Panorama Management. 

Steps are to be executed for each firewall in HA unit, so at any point of time there is always a firewall available to take care of the traffic flow.

Make sure to clear Enable Sync between the units till migration is complete.

Thanks

[Pradeepkumar064]

@bseal 

it makes sense, thanks for your time and effort!

[CyberEng]

Hi Pradeep can I ask what your final template stack / template setup was post-onboarding?  When I do this I am left with a spare template from the second firewall in the HA pair being imported and Im wondering if I can just delete this.

Did you finish up with 1 template containing 1 template and both firewalls i the pair assigned to the 1 stack?

Many thanks

[RodyDeLaRosa]

@CyberEng I have migrated over a dozen HA pairs, we always delete the orphan template, both devices in the HA pair remain under the template created by the first peer.