PA config replication through Panorama

[VarunRao]

Hi All,

I am looking for a method to replicate the configuration of one of our virtual firewalls to a physical firewall through Panorama device-groups and templates.

Let me explain the setup:

We have a core firewall with multiple vsys enabled, and one of these vsys is our external (internet) vsys. Now due to capacity issues, we need to replace this external vsys with a physical PA-5260 firewall (different hostname). The configurations would remain the same as in the external vsys and after migration vsys will be shut.

All the firewalls in the environment are manged by Panorama. The current external vsys is part of an existing device-groups and templates. Now I am looking for the best way to replicate the configurations from the current vsys to the phsyical firewall during productions cutover.

Is there a method to copy the security policies, nats, firewall settings from the old vsys to the new firewall through device-group or templates and during prod cutover, shut down the vsys and re-cable to the phsyical firewall and have the same configurations on it?

Any help would be highly appreciated.

[pawelzwierz]

There is a dedicated tool for migrations beetwen PAN and 3rd party vendors - Expedition

[VarunRao]

I am not moving from a different vendor to palo alto.  I am moving from a multi-vsys setup to a physical palo alto 5260 firewall.

[pawelzwierz]

Expedition is useful for any migration, between PAN also.

Load partial config can be use as well.