Migration assistance PA-5050 to PA-3420

[josemoura]

Hi,

I need assistance replacing a firewall cluster PA-5050 and standalone panorama by a firewall cluster PA-3420 and a cluster panorama.

Actually the firewall cluster PA-5050 and standalone panorama are in production. The templates network is manage in locally PA-5050 and the devices group is manage by panorama.

The new cluster PA-3420 is UP but the new panorama and collector not yet.

Here the informations for the currents devices:

PA-5050 X 2

Firmware version: 7.1.18

PANORAMA (VM):

Firmware version: 8.1.13

Here the informations for the new devices:

PA-3420 X2

Firmware version: 10.2.3-h4

PANORAMA (X2 VM):

Firmware version: 10.2.3

LOG COLLECTOR:

Firmware version: 10.2.3

Can you indicate me the steps and best practice for this migration ?

Regards

[JayGolf]

Hi @josemoura ,

I would recommend the following when doing this migration:

1. Prepare the new PA-3420s, ensure data ports match the PA-5050s, ensure data ports match correctly with PA-3420s, and upgrade to the desired code. I would recommend taking a look at the recommended release.

1. Update PA-5050s to match the current code of PA-3420 or desired code of PA-3420. 

2. Update Panorama to match the new Panorama code.

3. Import the device config template from the PA-5050 to the existing panorama. Ensure template and device group are up to date.

4. Prepare the new Panorama from the initial config, content, and software to match the previous Panorama or desired versions. If updating a new Panorama, ensure previous Panorama is updated to the desired code and versions first. 

5. Export Panorama config snapshot on old Panorama. 

6. Import the previously exported config into the new Panorama.

7. Add the collector the new Panorama.

8. Sync new Panorama with new 3420s. 

Please take a look at our guide for migration for further details. https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/set-up-panorama/transition-to-a-differ... .