Update steps RMA Replacement Firewall for case 2: Old device is still connected to the network and firewall is managed from panorama:

[VLim]

The following KB missing steps for version 10.1 as authentication key had introduce for this version onward

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clkn

Based on case 2 : 
if follow the steps provided the replaced firewall doesnt appear on the manage device and notice managed device is in disconnect state.

Tshoot steps as following KB
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkjSCAQ&lang=en_US%E2%80%A...

Based on the above KB it require generate authentication key

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkjSCAQ&lang=en_US%E2%80%A...

So what should be done is follow this KB steps 2 only
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkjSCAQ&lang=en_US%E2%80%A...

and go to Managed Firewall -> Panorama setting -> Enter the new auth  key -> Commit

Back to Panorama the replaced firewall still wont appear, open a new browser in private mode and login to panorama again then the new replace firewall shown in managed.