Step to change standalone for both device

[Oblagonte]

Hi All,

All our PA is managed by Panorama and there are a couple of HA pairs in our environment. we just want to change one of the HA pair to standalone.

Currently our set up is active passive. We would like change to standalone on both device. Is there any steps to make this happen?

Thanks !!

[SCantwell_IM · Accepted solution]

Hello

So, the FWs' configurations are pushed down by the Panorama to both FWs.  So each FW has an exact copy of the configuration (minus mgmt IPs, hostname, and HA configurations).

The steps I would take, is to log onto both FWs, go to Device Tab, and remove where the Panorama mgmt IP is located at.

Uncheck the "Enable Panorama device group" and "enable panorama template" and be VERY certain, to read the warning message, to ensure you IMPORT the Panorama FW configs onto the local FWs configuration.  If you do not, you will have zero config on the FWs.

Ok, so now that you have broken/take Panorama out of the equation, you will now have 2 FWs that are still in HA and both have the exact same IP configuration for the interfaces.    You need to break/remove HA, but also be sure to change the IP configuratations, so that you do not have 2 FWs with same public/private IPs (dupe IPs are not good in a network)

After that, you should have standalone FWs.

You may want to unplug all dataplane cables on the backup/standby FW, while you are committing, so that the active/primary FW continue to route the traffic, and then you reduce possible fighting over the IPs, while you are configuring/change the standby into standalone mode.

[Oblagonte]

Thanks Steve !!