Migrating configuration from the firewall running PAN-OS 9.1 to new firewall running PAN-OS 11.1 directly

[Tutchapon]

Hi LIVEcommunity

I plan to migrate the configuration from a PA-3020 firewall currently running PAN-OS 9.1 to a new PA-1410 firewall running PAN-OS 11.1.

I'd like to know if it's possible to directly import the configuration from the older firewall to the newer one, despite the difference in PAN-OS versions.

If direct import isn't recommended, please advise on the best practices and any necessary steps to ensure a successful migration.

[TomYoung]

Hi @Tutchapon ,

I completely understand that the latest version of the PA-3020 is 9.1, and the minimum release of the PA-1410 is 11.0.  So, you cannot match the PAN-OS.  https://docs.paloaltonetworks.com/compatibility-matrix/supported-os-releases-by-model/palo-alto-netw...

I have imported lower configurations (all 10.x) into PAN-OS 11.x, and they have worked great!  The new NGFW automatically converted the configurations.  I would definitely recommend you import directly to the PA-1410 to see if it works.  It would save you a lot of time.  If you do run into commit errors, we can assist.

Other options are to use a 3rd NGFW that can bridge the PAN-OS gap, or the migration tool (Expedition), but these will all take more time.

Thanks,

Tom