PA-200 to PA-440 running-config migration

[MYE-Support]

Is it possible to migrate a running-config from a PA-200 to PA-440 smoothly or would we have to manually configure some settings?

First issue is that the PA-200 is using PAN-OS version 8.x whilst the PA-440 is using PAN-OS 10.1, meaning we would likely have to use expedition based on research, correct?

Secondly seeing that the PA-200 has 4 ports that we have already configured, would it overwrite the ZTP port of the PA-440? What consequences would there be if we were to overwrite that interface?

Are there also any other configurations we should have to configure manually due to differences between the 2 firewalls? E.G. We would have to configure at minimum 3 ethernet ports after a potential migration avoiding overlapping of interface 1, leaving ports 6 7 & 8 requiring configuration. Is it possible to a running-config at all between the 2 without encountering much errors?

Are there any other considerations we should make whilst attempting to migrate the running-config of the PA-200 to PA-440?

Any help is appreciated!

[ozheng]

Hello MYE-Support,

Do you manage the PA-200 using Panorama?

If yes, you can add the PA-400, then put in the same template / DG as the PA-200.

Otherwise, you can export the config from the PA-200, import it to the PA-400, then commit / correct the errors (if any).

Olivier

[TomYoung]

Hi @MYE-Support ,

1. You can upgrade the PA-220 to 10.1.  You do not have to use Expedition unless you want to.  It is very easy to export the config from PA-220 and import into PA-440.  I expect little or no errors on commit.  Please verify the management interface settings before commiting.
2. You can disable ZTP on the command line before the import.

I have exported and imported configs from many NGFWs with different models.  In most cases, the config is exactly the same.  Some people prefer to export and import the device state, but I haven't noticed any difference.

Thanks,

Tom