Migration of Panorama which has NGFW Clustering to new Panorama

[gsyed]

This technical article provides an end-to-end workflow for migrating a Panorama management server in environments utilizing Next-Generation Firewall (NGFW) Clustering. Unlike traditional High Availability (HA), NGFW Clustering requires specific handling of the clustering plugin.

Technical Prerequisites & Compatibility

• Software Alignment: The target Panorama must match the source's PAN-OS version and Panorama Clustering Plugin version or higher to avoid any config issues.
• Licensing: Verify that the target Panorama has the necessary licenses to manage the specific number of cluster nodes.

• Connectivity: Verify that the target Panorama has reachability to new firewall clusters.

Step 1:

On the source Panorama, navigate to Panorama > Operations.

Click Save named Panorama configuration snapshot to create a restore point .

Step 2:

Click Export named Panorama configuration snapshot and save the XML file externally .

Step 3:

Import the configuration XML via Panorama > Operations > Import named Panorama configuration snapshot .

Step 4:

Important:

Make sure to change the IP address of the management interface in the new Panorama when you import the configurations:

Step 5:

Click on Commit.

Make sure the devices show as Connected in the new Panorama as shown below:

Panorama > Summary

Note:

If the devices are not getting connected in Panorama, its most likely to the device registration key needs to be reset, please follow the below documentation to reset the keys:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wlJpCAI&lang=en_US

Step 6:

In the template stack make sure, the “Enable Clustering” is enabled or else it will throw an error:

Step 7:

Add the devices to the Clustering.

Panorama > Firewall Clusters:

Step 8:

Once done, click on commit on Panorama and the Cluster should show up as in sync in new Panorama: