This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Cookie Policy. Click Preferences to customize your cookie settings.
About m.hughes1
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About m.hughes1
10-27-2022
3Posts
0Likes
0Solutions
Oct 27, 2022Last Visited
User
Activity
User
Profile
Latest posts by m.hughes1
| Subject | Views | Posted |
|---|---|---|
| 666 | 09-28-2022 06:43 PM | |
| 690 | 09-28-2022 05:40 PM | |
| 846 | 09-23-2022 09:22 AM |
User Badges
Community Statistics
| Member Since | 03-23-2020 05:00 PM |
| Date Last Visited | 10-27-2022 11:08 PM |
| Posts | 3 |
09-28-2022
06:43 PM
I took a second look after you mentioned the error most likely being a conflict, and originally I was confused because the error referenced the serial numbers of the devices in the Original Device Group. But then I saw when the rule was created, they put those specific devices in the target field. So that was resolved.
I will go through and clean up the rest of the conflicts. This seems to put me on the right track.
... View more
09-28-2022
05:40 PM
Thank you so much for your reply, this made a lot of sense.
So here is where I stand right now, and the dilemma I have,
I brought up the new 5220's, and I made the changes to the interface configurations, and cloned the template, and made a new template stack, and was able to get all of the template items pushed to the new 5220 HA pair through Panorama.
But when it comes to the device group, we have roughly 500 NAT rules, a lot of which reference the interface in the translation; and since the interface is not the same it errors out when pushing to the devices.
So my thought was to create a new device group since I can't use the old for the above reason. But I can't find any way to clone the Device Group, and I dont want to re-create 500+ ACLs and 500+ NAT rules.
I looked it up and saw the partial load configuration command line, but I keep getting invalid syntax, and I tried creating a new Device Group and cloning just the NAT rules to it but that throws an error as well when I try to clone them to the new device group.
Trying to find a way to get this device group cloned, so I can then edit the NAT translations to reflect the new interface mappings.
... View more
09-23-2022
09:22 AM
Seeking a little bit of advice with an upcoming Migration we are performing.
We currently have an HA pair of PA-3050's that are being managed within Panorama (M-200). This HA Pair, is one of (2) Perimeter Firewalls we have in place going to our ISP. So within Panorama this HA pair is in 2 device Groups. Which is making me second guess what the process should look like.
Right now we basically have a Device Group for HA Pair 1, and HA Pair 2, that are separate, for applying rules that pertain to DMZ's that exist exclusively on those pairs, and then we have a Device Group that contains both Pair 1 and 2, which is for managing outbound Inet rules from internal networks.
The plan is to save and export the configuration of both devices in this HA pair 1, and load and import them onto the 2 new 5220's. Then configure HA, and configure the ports, and verify configuration is good.
But then when it comes to Panorama Management, would I have to Import the configuration of this device to Panorama and create a new solo object group for it, and remove the old HA pair group? -- then add it to the perimeter device group from there?
Hoping my question makes sense here.
Thanks,
Marshall
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-27-2022
11:08 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks