PA-440 to PA-1410

[VeronikaS]

I have a PA-440 running PAN-OS 10.2 and a target PA-1410 running PAN-OS 11.4.7-h1.
I would like to export the configuration from the PA-440 and migrate it to the PA-1410 without upgrading the PA-440.

every time i import the PA-440 config to the 1410, i cant access the new FW with https, and it does not show all the interfaces it has. 

[kiwi]

Hi @VeronikaS ,

You can’t just drop a config file from a different hardware platform into a box like the 1410 and expect it to work.

When you import the full configuration (the config.xml), you are overwriting the hardware-specific settings of the new firewall with the settings of the old one.

Basically you have to edit the XML config file manually.

When you import the PA-440 config, you are likely importing the Management Interface settings too. Some examples of why it could go wrong:

• If your PA-440 was 192.168.1.1 and your new PA-1410 was 192.168.1.254, the 1410 just changed its own IP to 192.168.1.1 the second you hit "commit."

• If there was an SSL Service Profile or a specific Management Access Mask (permitted IPs) on the 440, the 1410 is now enforcing those. If your computer isn't on that "permitted" list, you're locked out.

The PA-440 has a fixed, small number of ports. The PA-1410 has more. So it's expected you're not seeing the same number of interfaces.

• When you import the PA-440 config, the 1410's configuration database is told: "You only have these specific ports (ethernet1/1, 1/2, etc.)." * It essentially ignores the extra physical ports on the 1410 because they aren't defined in the XML file you just uploaded.

Here are some discussions and article on the topic which could give you some direction:

migrate-model-fw-to-virtualwith-panorama-for-policies

how-to-migrate-from-a-pa-7050-to-a-pa-5250

DotW: Restoring Configuration Between Platforms 

Hope this helps,