About Gchander

I have PA 5050 setup as  Fast and Nokia device as slow. This setup works fine since last 4 years.   ... View more

Excellent question   Here are steps from the Panorama 220 course.   Configure the management interface of the new firewall. Review and update the PAN-OS software. Review and update the dynamic updates.   Use the Palo Alto Networks Customer Support Portal to transfer license assignments from the serial number of the old firewall to the serial number of the new firewall   From the Panorama command line, execute one of the following commands: > scp export device-state device <old-serial#> to <login> @ <ServerIP>: <path> > tftp export device-state device <old-serial#> to <login> @ <serverIP>: <path> To replace the serial number of the old firewall with the new one, execute the following commands: > replace device old <old-serial#> new <new-serial#> > configure # commit   Access the management user interface of the new firewall: Import the device state. Perform a commit after the import is complete.   On Panorama: Select Commit > Commit and Push and Edit Selections in the Push Scope. Select the Device Groups tab and select the device group that contains the new firewall. Select Include Device and Network Templates.       ... View more

@Gchander Strictly speaking configuration can be applied on any member, but yes, it is better to work on the Active in Active/Passive when no Panorama. It is becuase it is the firewall processing traffic and also some services run on the Active . So for example, if you make a policy change you can only check the traffic logs on the Active member to verify the result.  ... View more

Hi   Interfaces and Sub Interfaces are added under import->network as a list of interfaces. In my PA3020 I had to delete it from there before deleting the interface otherwise I got an error that it is referenced elsewhere.   As far as I know this must be done one by one, but you should check you environment, you might get more errors that this is referenced in other places (virtual router for example) which will not let you delete the sub interface until all references are deleted first.   Here is a tip: In operational mode ('>') type 'set cli config-output-format set' Then all show commands in configure show the commands, one by one as 'set' commands - this will ease finding the correct command path.   Shai   Shai ... View more