Move firewall to new Panorama

[securehops]

Hi All,

We currently have 2 Panoramas (virtual) managing different firewalls..  We'd like to move all firewalls to 1 pano, so we can retire the other one.   What's the best/safest way to accomplish that?  Is there a way to avoid having duplicate objects while migrating or would it be a cleanup effort after the fact.   It's a mix of standalone firewalls and HA (active/passive) firewalls.   These are all in production, so concerned about downtime.

I know there is a process to import standalone firewalls into panorama, but these firewalls are already managed by pano.

[TomYoung]

Hi @securehops ,

Here is the link for "load config partial" again.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClbLCAS

Thanks,

Tom

[securehops]

Thanks @TomYoung .  I do have the link.  Sorry, I meant I'm having trouble finding the proper items to import.  When I went to <panorama ip>/api,  I'm not seeing anything for device groups and templates

[TomYoung]

Hi @securehops ,

In the scenarios in the link, you load the config from a file.  The XML API only shows the running-config.  You can use the API to get the generic XML Path (XPath), and change the name of the device group or template that exists in the configuration file.

You may need to go through the link again.

Thanks,

Tom

[securehops]

@TomYoung 

I was reviewing this article https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-cli-quick-start/use-the-cli/load-configurations...

I guess I thought I would be able to import a partial config and pull in all the device groups and templates that I want to bring in but maybe I need to do them one at a time?

load config partial mode merge from-xpath 

devices/entry[@name='localhost.localdomain']/device-group/entry[@name='<my device group name>']/  to-xpath 

/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='<my device group name>']/ from myfilename.xml

Then for something template, I'm guessing it would be 

load config partial mode merge from-xpath 

devices/entry[@name='localhost.localdomain']/template/entry[@name='<my template name>']

Going to open a TAC case to see if they can assist

[TomYoung]

Hi @securehops ,

Exactly.  That's what I had in mind.  I'm sorry.  How many device groups and templates do you have?  You could try the load from-xpath with just /device-group/ and /template/ without the /entry/....  That would may also merge the shared device group which may be what you want.

Thanks,

Tom

[securehops]

In this Panorama, I have 2 device groups and 4 templates (and 4 template stacks)

[TomYoung]

Thank you.  That's not terrible to move them one at a time.  Sorry for the misunderstanding.

[securehops]

hi @TomYoung 

Unfortunately, didn't have any luck with this.  Kept getting errors Server error : input file doesn't have anything at devices

Spoke with TAC about it, after some review with their resources, they are saying since the two panoramas are managing different firewalls, the only option for the panorama (that we want to get rid of) is convert each firewall to local config and import the full config into the panorama  we want to keep

[TomYoung]

Hi @securehops ,

Your from-xpath should be /config/devices/.... The fact that TAC didn't point that out is interesting.

Load config partial can be a pain to learn, but once you do you can save a lot of time.  Your scenario is a perfect example.  Merging the configuration will be a lot quicker than pushing the config locally for all your devices and importing them.  With regard to import, there are a couple gotchas to be aware of.

Thanks,

Tom

[securehops · Accepted solution]

@TomYoung thank you very much for your assistance.

I was able to successfully import all the configuration from the to-be-retired panorama, following these steps

Step 1: Import the serial numbers into panorama

load config partial mode merge from-xpath /config/mgt-config/devices to-xpath /config/mgt-config/devices from exported-panorama-cfg.xml

Step 2: Load shared objects into Panorama

load config partial mode merge from-xpath /config/shared to-xpath /config/shared from exported-panorama-cfg.xml

Step 3: Import the templates into panorama

load config partial mode merge from-xpath /config/devices/entry[@name='localhost.localdomain']/template to-xpath /config/devices/entry[@name='localhost.localdomain']/template from

exported-panorama-cfg.xml

Step 4: Import any template stacks into panorama

load config partial mode merge from-xpath /config/devices/entry[@name='localhost.localdomain']/template-stack to-xpath /config/devices/entry[@name='localhost.localdomain']/template-stack from exported-panorama-cfg.xml

Step 5: Import device groups into panorama

load config partial mode merge from-xpath /config/devices/entry[@name='localhost.localdomain']/device-group to-xpath /config/devices/entry[@name='localhost.localdomain']/device-group from exported-panorama-cfg.xml

This all imported with no errors.   The last step is to point the firewalls to the new panorama, which I will try in early January.   I will update the thread with the results

Thx again

[securehops]

As promised, I am here with an update.  I was able to successfully move firewalls over to the new Panorama.   I ran into an issue where the firewalls would show as disconnected on the new Panorama.    

I remembered this article, as helpful for similar issues in the past

https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/troubleshooting/recover-managed-devic...

In this case, I only needed to clear the device state on the new Panorama using CLI command

clear device-status deviceid <device_SN>

Thanks again @TomYoung @JayGolf