Moving between device groups

[jasonrakers]

I am looking to move my firewalls from one Panorama (7.0.3) device group to a new device group.  All active policy rules have been cloned over to the new device group from the existing device group, and the objects are all "shared". 

Even though all the rules being installed are the same, and being installed on the same set of firewalls, just under a new device group name.  I fear that since there are active NAT rules, and there may be some NAT related issues when the new device group gets applied.

Does any one know of any issues when migrating between device groups?

[jasonrakers]

Here is the response from Palo Alto support -

it is suggested to perform the change during a maintenance window since its wiping and rewriting to the firewall.

[reaper · Accepted solution]

Hi

Although all objects and policies might be identical, because the firewall is being moved between different device groups the entire previous configuration will get removed and replaced by a new one (replacing the old xml with a new one in essence)

This means all objects will be removed and readded and could be assigned a different 'id' by the idmgr process, causing mismatches in existing sessions (each newly added object, zone, rule, ... is assigned an 'id' which is then used by the underlying engines to properly match sessions)

It's recommended to perform this task during a maintenance window to minimise impact

regards

Tom

[jasonrakers]

after moving device groups and commiting the new device group to the firewalls, no noticable impact to traffic was detected.

[MP18]

I am also planning to do this in coming days.

Seems for you it worked without any issues right?