Palo Alto migration

on

 Here's a comprehensive guide for migrating from PA-820 firewalls to PA-4110 firewalls. This is a same-vendor (PAN-OS to PAN-OS) migration, which is significantly cleaner than cross-vendor migrations.

PA-820 → PA-4110 Migration Overview

The PA-4110 is a much higher-capacity platform (data center/campus core class), so this is an upgrade in tier — the config is largely portable, but there are key differences in interfaces, licensing, and PAN-OS versions to account for.

Phase 1: Pre-Migration Planning

Hardware/Platform Differences to Note:

  • The PA-820 has 8× 1G copper + 4× SFP ports; the PA-4110 has 16× 25G SFP28 + 8× 10G SFP+ ports — your interface assignments will change
  • The PA-4110 supports multi-VSYS natively at higher scale
  • Confirm your SFP/SFP+ transceivers and cables are compatible with the 4110's port types
  • PA-820 is End of Sale (EoS) as of 8/31/2024 — new licenses will be tied to the PA-4110

Documentation to Collect from PA-820:

  • Current PAN-OS version
  • Interface layout and cabling diagram
  • Zone and routing configuration
  • HA configuration (if applicable)
  • Panorama management status
  • Active licenses and subscriptions

Phase 2: Version Alignment

The configuration import requires matching the major PAN-OS version. Upgrade the new device to the same PAN-OS version prior to import. Additionally, make sure all components are in the same version — PAN-OS, PAN-DB, Threat Prevention, Wildfire, and GlobalProtect — including licenses.

Steps:

  1. Note the exact PAN-OS version running on the PA-820 (e.g., 10.2.x)
  2. Upgrade the PA-4110 to match that version before importing config
  3. Download and install matching dynamic updates (App & Threat DB, WildFire, etc.)

Note: If the PA-820 is on a very old PAN-OS that the PA-4110 cannot run, you'll need to upgrade the PA-820 first, validate it, then export. The PA-4110 supports PAN-OS 10.1+.

Phase 3: Export Configuration from PA-820

Save a Named Configuration Snapshot from the GUI: go to Device > Setup > Operations and select "Save named configuration snapshot." Then export it via "Export named configuration snapshot."

From the CLI alternatively:

> configure
# save config to PA820_backup.xml
# exit
> scp export configuration from PA820_backup.xml to username@scpserver/backups/

If managed by Panorama, also export the device state: Go to Device > Setup > Operations > Export device state — this captures certificates and other items not part of the standard config XML.

Phase 4: Prepare the PA-4110

Register and add licenses for the new firewall on the Palo Alto Networks support portal. You can transfer licenses to the new firewall as well.

  1. Complete initial setup (management IP, DNS, NTP)
  2. Register device on support.paloaltonetworks.com
  3. Activate all relevant subscriptions (Threat Prevention, URL Filtering, WildFire, DNS Security, etc.)
  4. Bring PAN-OS and all dynamic updates to the same version as the PA-820

Phase 5: Edit the Configuration XML (Critical Step)

Because the interface names differ between the two platforms, you must edit the exported XML before importing:

The main issue you'll encounter is interface changes — if you're using interfaces on the source that don't exist on the destination. You can update that interface information in the GUI or find/replace it in the XML configuration file before loading it onto the new firewall.

Common interface remapping (example):

PA-820 Interface PA-4110 Equivalent
ethernet1/1 (copper) ethernet1/1 (SFP28 — needs transceiver)
ethernet1/7 (SFP) ethernet1/7 (SFP28/SFP+ with adapter)

Use a text editor or script to find/replace interface names in the XML before import.

Phase 6: Import and Load Config on PA-4110

Log into the PA-4110, go to Device > Setup > Operations, and under Configuration Management, click "Import named configuration snapshot." Select the configuration file you backed up from the PA-820.

Then: Go to Device > Setup > Operations and click "Load named configuration snapshot." When the configuration has been selected, click OK.

If you exported device state (Panorama-managed): go to Device > Setup > Operations > Import device state so all certificates are also imported, which are not part of the standard config.

Phase 7: Validate Before Commit

The validation process will catch anything that won't actually function on the new platform (like interface mismatches), so you can go through and correct them before committing.

Check:

  • All interfaces are mapped correctly
  • Zone bindings are intact
  • Routing tables and virtual routers are correct
  • NAT rules reference valid interfaces/zones
  • Security policies look complete
  • HA configuration updated if applicable

Then commit the configuration.

Phase 8: Panorama Re-Registration (if applicable)

Delete the old firewall from the device group, template, and managed devices in Panorama. Add the new firewall in managed devices and add it to the appropriate template and device group.

Phase 9: Post-Migration Validation

  • Verify traffic is passing through all zones
  • Check threat logs, URL filtering, and WildFire are activating
  • Confirm HA sync if deployed in HA pair
  • Review session table and routing table
  • Monitor CPU/memory baselines (the PA-4110 will have significantly more headroom)
  • Keep the PA-820 offline but available for rollback for at least 24–48 hours

Key Gotchas to Watch For

Risk Mitigation
Interface type mismatch Pre-order correct SFP transceivers for PA-4110
PAN-OS version gap Upgrade PA-820 first if needed, validate, then export
License transfer Initiate via Palo Alto support portal before cutover
HA pair migration Migrate one unit at a time; validate sync before cutting over
Certificates Use "Export/Import device state" to carry certs over

Let me know if you want to go deeper on any specific part — HA migration, Panorama-managed deployments, or the interface remapping in XML.

Comments

Post a Comment