Replacing a managed old hardware model with a new model

[alberty]

Hi,

I am going to replace my old 3020 9.0 panorama-managed firewalls with a pair of 5200 series FW. During the process I’ll need to change some of its network interfaces configurations with vpn tunnels on the new model. Would you advise to change the old serial to new in the panorama configuration, or should I import the new model into panorama from scratch and erase the existing old model configurations from the template stack?

thanks.

[BPry · Accepted solution]

@alberty,

If it was me I would import the 5200 into Panorama and configure it from there instead of replacing the serial.

[MP18 · Accepted solution]

@alberty 

I have done quite a few migrations like this.

I prefer config new pair import config to panorama.

Make sure it has all the config as desired then on cutover day just move the physical data connections from old to new one.

Regards

[alberty]

Thanks, that's what I think too! 

[alberty]

Hi @MP18 ,

But there is a problem as the policies are not present in the configuration snapshot export, how can I get a copy of the rule base related to the device and then have further edited? Is it a must to use the device export?

[MP18]

@alberty 

You can use device export and then import all config to new PA and then you can edit it.

After that you can add that to Panorama.

Regards

[alberty]

Hi Thanks. I have exported the config snapshot and modified the xml and imported the devices as new in Panorama.