I am migrating a Palo HA pair VM to a new host and I would like to validate the steps if anyone can assist.

Showing results for 
Show  only  | Search instead for 
Did you mean: 

I am migrating a Palo HA pair VM to a new host and I would like to validate the steps if anyone can assist.

L0 Member

I have the following steps laid out. Please have someone verify if this is correct or if I have forgotten anything. I am migrating the HA pair to a new host with vMotion. 

- We are running vSphere 7.0 (ESXi host migration is 6.5 > 7.0) please confirm if I need to suspend the heartbeat

- I read that I need to select "This guest was moved" to prevent license invalidation - where is this done?

- Suspend active FW to force failover
- Shut down suspended VM
- Migrate over
- Bring up VM on new host
- Unsuspend VM on new host and suspend VM on old host to force failover.
- Migrate over 2nd VM to new host.


Thank every one in advance!




L1 Bithead

Good morning,


I dont know if you have completed this migration yet but we recently did it ourselves to separate the active/passive VM-300's. You do have to disable the HA connections between the two before you migrate the machines. It states that you can move the machine while it is still running but in our case we were only moving the passive so we powered it down before the move. Once moved we were able to fire it back up and reconnect the HA connection with no issues. 

On a side not do not clone the firewall that you are moving as it does not take the product keys' and configuration needed with it. Learned the hard way.


Hope this helps

Cyber Elite
Cyber Elite

What made you decide that HA needs to be disabled?

If you shut down passive for migration then active stays active and HA will sync up again when passive is powered up at new location.

It would only be needed if old host and new host don't have network connectivity.

In this case yes HA needs to be disabled to avoid split brain situation.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

It was just as a precaution my company wished to take when dealing with any movement or upgrades to the firewalls that's all. I know it would pick right back up if left on and once we powered the passive back up, we turned HA back on.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!