To test this feature, visit your live site.

Palo Alto Upgrade-migration from 5050 ( HA ) to 5220 ( HA ) recommendations

Hello good afternoon, first of all, thank you for your cooperation.

I have the following question regarding a migration.

Firewall source PA-5050 version 8.1.X ( HA ), configuration, with destination to 5220 HA, with PAN-OS 10.1.X ( recommended version of 10.1.X ).

Now I have the following doubt, what is recommended for the upgrade.

-To take the config of 5050, export and load config in the PA-5220, adjust, but the 5220 to have it first in PAN-OS 9.1.X, and after having the config, move it to 10.0 and then finally to 10.1, thinking about the correct conversion of configurations ?

-Or do you recommend to take the 5050 config, pass it to the 5220 and adjust it, but already with the 5220 firewall in version 10.1.X (PAN-OS 10.1.X recommended)?

What do you suggest is the best option ? what is your opinion, suggestion, proposal and / or recommendation or any other tips and / or input.

Thanks

I remain attentive to your comments

Best regards

3 comments

Comments (3)

Reaper

Nov 10, 2022

If you have time, I would downgrade the 5220 to 9.1 and import the config from the 5020 You may run into some issues but there will likely be less problems to solve than trying to import the 8.1 into 10.1 You don't happen to have a panorama? That would simplify the config migration

MetgatzGR

Nov 10, 2022

Replying to

Hello @Reaper

As always, thank you for your comments, contributions and advice.

No, we do not have PANORAMA, for this migration, in another occasion we had a 7.1.15 and of course with Panorama 9.1.X, the migration from 7.1.X to 9.1.X is more transparent or less noisy.

Now we need to leave the 5220, in 10.1.X, from a Firewall and 8.1.X config.

If it is what we thought, extract the 5050 config, then move to the 5220, but with 9.1.X as a minimum, for coding issues, adjust, polish the config. And then see that everything works correctly, perform the upgrade to 10.0.X and 10.1.X (recommended version of the moment by the TAC of PA).

I remain attentive to your comments.

Best regards

MetgatzGR

Nov 10, 2022

Replying to

Hello @Reaper

And added to the last answer. Thinking about Expedition. Will it be possible also, a possible option, to take the 5050 config in 8.1. Upload it to Expedition and also upload a clean version of 10.1.X to Expedition as Base Config, and do merge to have a final 10.1.X file, based on the 8.1.X config. Then export from Expedition and upload and upload to the 10.1.X firewall ?

I remain attentive, thank you, best regards.

Forum: Forum