Panorama Migration VM - to - VM

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
sellington
L1 Bithead

Panorama Migration VM - to - VM

Hello,

 

we have an interesting setup, we currently have Panorama in legacy mode at version 9.0.4 (didn't even know it was possible to be in legacy mode on that release) managing a couple of HA pairs of firewalls. We would like to move our config to a Panorama VM in Panorama mode at version 9.1.2 and was looking for some guidance. 

 

For some reason, I am guessing how the VM was originally provisioned, we have no way of editing the resources on our existing Panorama VM, so we cannot upgrade our existing Panorama deployment, but instead need to migrate it to a newly provisioned fresh Panorama VM that we spun up (9.1.2 running in Panorama mode). 

 

Does anyone have any guidance on how to migrate this config? Can we export the config snapshot -> import on the new VM -> and then convert to legacy mode? If this is possible will this lose our log settings in Panorama?

 

How do we handle this from the licensing perspective?

 

Once we are on the new VM and have transferred the license, can we still view historical logs as needed on the old Panorama VM?

 

I have a ticket open with support for guidance as well, but was looking to see what the communities thoughts were. 


Accepted Solutions
reaper
L7 Applicator

you can't go 'back' to legacy mode once you're in panorama or management-only mode, so you will need to build a log collector on the new panorama instead of relying on the built-in log partition

upside is that you can expand storage way beyond the 2tb limit in legacy mode

 

you can export and import your config snapshot and you'll be up and running in no time, once the log collector is configured and added to a log collector group, firewalls wil automatically log into the log collector

 

license wise you can simply copy your serial over to the new VM, you'll need to decommission your old panorama so you don't break your support contract

 

one caveat is that the new panorama will have the same IPs but different certificates, so you will need to clear the 'known-hosts' file of the panorama IP so the firewall can start trusting the new panorama

> delete authentication user-file ssh-known-hosts user ip <ip>
Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374

View solution in original post


All Replies
reaper
L7 Applicator

you can't go 'back' to legacy mode once you're in panorama or management-only mode, so you will need to build a log collector on the new panorama instead of relying on the built-in log partition

upside is that you can expand storage way beyond the 2tb limit in legacy mode

 

you can export and import your config snapshot and you'll be up and running in no time, once the log collector is configured and added to a log collector group, firewalls wil automatically log into the log collector

 

license wise you can simply copy your serial over to the new VM, you'll need to decommission your old panorama so you don't break your support contract

 

one caveat is that the new panorama will have the same IPs but different certificates, so you will need to clear the 'known-hosts' file of the panorama IP so the firewall can start trusting the new panorama

> delete authentication user-file ssh-known-hosts user ip <ip>
Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374

View solution in original post

cliffgormley
L0 Member

Hi Tom

I just bought your book!

If you have some time to go over a few questions I have on a Panorama-to-Panorama migration, that would be great!

Thanks

Cliff

 

reaper
L7 Applicator

Hi cliff @cliffgormley  Yay!!

I'd love to, but please don't post your phone number to a public forum

 

You can reach me via reaper@pangurus.com

 

 

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!