Backup of Virtual Appliance

[liewtienqing]

Hi PA forums,

I had a question, is it recommended or wise to backup a VM series PA?

Thanks.

(tried googling, but kept giving me virtual backup appliances results)

[Raido_Rattameister]

You can export running config from firewall.

If you push config from Panorama then device state is best option as running config export don't include config came from Panorama.

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/firewall-administration/manage-configurat...

Although taking snapshots works 99.9% of the time it is not officially supported so can't suggest that.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POL6CAO

[liewtienqing]

thanks Raido.. it is a PA firewall though, not Panorama.

And the backup solutions is like VM backup, not snapshots.

Is it still not recommended?

[Raido_Rattameister · Accepted solution]

Although it says Panorama in the header there is answer part that states "Do not use the VMware snapshots functionality with any PAN virtual machine as it is NOT supported."

It is also mentioned here:

https://docs.paloaltonetworks.com/vm-series/11-0/vm-series-deployment/set-up-a-vm-series-firewall-on...

"

• Do not use the VMware snapshots functionality on the VM-Series on ESXi. Snapshots can impact performance and result in intermittent and inconsistent packet loss.See the VMware best practice recommendation for using snapshots.
  If you need configuration backups, use Panorama, or from the firewall, use 

  Export named configuration snapshot (Device > Set up > Operations). Using Export named configuration snapshot

   exports the firewall’s active configuration (running-config.xml) and allows you to save it to any network location."

Most backup solutions (there are some exceptions) instruct VMware to take snapshot, then copy data over and then instruct VMware to remove snapshot. So you need to check with your backup software what exact procedure they use.

[liewtienqing]

OK thanks, I guess the general advice is consistent enough