Replacing PA-5220 with a PA-3410 and need the best practice to migrate over configuration

[Scolan]

Replacing PA-5220 with a PA-3410 and need the best practice to migrate over the configuration. Obviously the network interfaces are different and will require some cleanup, that and I know to match the PAN OS in the devices to avoid possible complications. Having not done this before what else should I look out for?

Thank you!

[reaper]

you summarized all you need to take care of in this case:

- make sure both systems are on the same PAN-OS

- review your interfaces as the coper/fiber ratio is different on the 3400, you may need to move some interfaces around (you can rename them in the config file before importing onto the new device)

other then the above two, make sure the new device is fully updated to the latest content packages (antivirus, apps&threats, ...)  equal to or greater than the 5200

[WalidIsmail]

we have the same situation , with vsys configuration on pa5220 . But the problem is that the pa3410 is bought without vsys . what are the best solutions to migrate ? does we need to purchase vsys for sure on the pa3410 or we can mitigate this?

[OtakarKlier]

Hello @WalidIsmail ,

Can you clarify what you mean the pa3410 was purchased without vsys? This will help us respond to your inquiry better.

Regards,

[WalidIsmail]

we have only vsys1 in the pa3410

[OtakarKlier]

Hello,

That is how they all start out of the box. You need to add additional if you require them.

Regards,

[WalidIsmail]

Hello @OtakarKlier ,

yes , i know that , but lets say , in the purchase process we forgot to buy the vsys and there is no budget for it  ( example) . can for example push the configuration to panorama and then from panorama push it to the new firewall ? in this case what kind of consideration and limitation we will have?