How to move firewalls between Panoramas

[szabo_sandor]

All NGFWs within a company are currently managed centrally from a central Panorama. The question is how to move a subsidiary's (business unit's) NGFWs and all related configurations (device groups, templates, template stackss, shared objects, etc.) from this central Panorama to a new Panorama installed locally at the subsidiary? We couldn't find a description for this use case, what are the steps to move some firewalls from one Panorama to another so that the moved firewall's operation is not interrupted and they can be managed from the new Panorama after the move?

[TomYoung]

Hi @szabo_sandor ,

You mentioned moving "all related configurations".  So, I assume there is no configuration on the new Panorama.  In that case, you would remove the NGFW from Panorama following this document -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cmd6CAC being very sure to check the boxes to import the configurations locally.  You then have a locally managed NGFW.

The next step would be to follow this doc -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloRCAS to import your locally managed NGFW to Panorama.  Be very sure to follow step 5 and use the Panorama > Setup > Operations process to push the initial config to the device after import.  This step actually deletes the local policies and objects on the NGFW so that you do not get conflict errors. Do not use the Commit menu until afterwards.  

One step that is not in the 2nd doc is that is you want the Template values (Network and Device configuration) to be managed by Panorama you need to select Force Template Values when you do your 1st Commit and Push (or Commit to Panorama and Push to Devices).  Then all your policies, objects, network, and device configuration will be managed from Panorama.

Thanks,

Tom