SSL Certificate update while GP migration

[Rajesh-Networks]

Hello,

I have scheduled all activities for my FW migration from ASA to PA, however I have a question about GP migration.

The PA FW has its GP deployed with Public IP x.x.x.6 and gp.domain.com, whereas the ASA has Anyconnect on Public IP x.x.x.5 with asa.domain.com. Both are currently connected to the same ISP; 

I have disabled Anyconnect, and people have been started using GP which is with public IP address x.x.x.6 and DNS gp.domain.com.

Now that we plan to totally shut down ASA and assign the Public IP of ASA to PA during the cutover, the subsequent steps are planned to be performed out.

* PA gp.domain.com's DNS entry will be modified to point to public IP x.x.x.5.

* The public IP address x.x.x.5 will be assigned as PA external IP.

I have two questions about this.

1) How long will it take for the DNS to propagate to reflect the new IP if we make this DNS update during the cutover (6 hours)?

2) If we switch the DNS entry to the new IP x.x.x.6 will there be any issues as the same SSL certificate gp.domain.com is now active on IP x.x.x.5? Can we use the same certificate as I'm hoping it's based on DNS rather than IP?

Looking for suggestions on this.

Thanks in advance!!!

Rajesh Venugopal.

[Rajesh-Networks]

Any suggestions from anyone 🙂 ?