Migrate a Firewall HA Pair to Panorama Management and Push a New Configuration

Plan the migration.
See the checklist in Plan the Transition to Panorama Management.
Disable configuration synchronization between the HA peers.
Repeat these steps for both firewalls in the HA pair.
Log in to the web interface on each firewall, select
Device
High Availability
General
and edit the Setup section.
Clear
Enable Config Sync
and click
OK
.
Commit
the configuration changes on each firewall.
Add the firewall as a managed device.
See Add a Firewall as a Managed Device for more information on adding a firewall to Panorama management.
Log in to the Panorama Web Interface
Select
Panorama
Device Registration Auth Key
and
Add
a new authentication key.
Copy Auth Key
after you successfully create the device registration authentication key.
Select
Panorama
Managed Devices
Summary
to
Add
a firewall as a managed device.
Enter the serial number of each firewall in the HA pair and click
OK
.
To add multiple firewalls at the same time, enter the serial number of each one on a separate line.
Select
Commit
Commit to Panorama
and
Commit
your changes.
Set up a connection from the firewall to Panorama.
Repeat these steps for both firewalls in the HA pair.
Log in to the firewall web interface
Select
Device
Setup
Management
and edit the Panorama Settings.
In the
Panorama Servers
fields, enter the IP addresses of the Panorama management server.
Paste the
Auth Key
you copied in the previous step.
Click
OK
and
Commit
.
On the Panorama web interface, select
Panorama
Managed Devices
Summary
and verify that the
Device State
is
Connected
.
Add a Device Group.
Repeat this step to create as many device groups as needed to logically group your firewall configurations. Device groups are required to manage device group objects and policies. Learn more about how to manage your device groups.
You must add the HA peers to the same device group.
Create a template and template stack.
Templates and template stacks are used to configure the firewall
Network
and
Device
settings that enable firewall to operate on the network.
Add a Template.
Repeat this step to create as many templates as needed to define your required networking configurations.
Configure a Template Stack.
Repeat this step to create as many template stacks as needed to quickly apply your defined networking configurations. When you create a template stack, assign the relevant templates and managed firewalls.
You must add the HA peers to the same template stack.
Configure the device groups, templates, and template stacks as needed.
Push the device group and template stack configuration changes to your managed firewalls.
You must first push the device group and template stack configuration to your
passive
or
Active-Secondary
HA peer first and then to the
active
or
Active-Primary
HA peer.
Log into the firewall web interface of the
Passive
or
Active-Secondary
HA peer and select
Device
High Availability
Operational Commands
to
Suspend local device for high availability
.
Push the Panorama managed configuration to the
suspended
HA firewall.
Log in to the Panorama web interface.
Select
Commit
Push and Push
and
Edit Selections
to modify the Push Scope.
Merge with Device Candidate Config
—This setting is enabled by default and merges any pending local firewall configurations with the configuration push from Panorama. The local firewall configuration is merged and committed regardless of the admin pushing the changes from Panorama or the admin who made the local firewall configuration changes.
Disable this setting if you manage and commit local firewall configuration changes independently of the Panorama managed configuration.
Force Template Values
—Overwrites any local firewall configurations with those in the template stack configuration pushed from Panorama in the event of conflicting values.
This setting is enabled by default. Enable this setting to overwrite any conflicting firewall configurations with those defined in the template or template stack. Before enabling this setting, review any overridden values to ensure an outage does not occur.
In
Device Groups
and
Templates
, select the suspended HA firewall.
Click
OK
and
Push
.
In the firewall web interface of the suspended
passive
or
Active-Secondary
HA peer and select
Device
High Availability
Operational Commands
to
Make local device functional for high availability
.
Log into the firewall web interface of the
active
or
Active-Primary
HA peer and select
Device
High Availability
Operational Commands
to
Suspend local device for high availability
.
Repeat Step 2 to push the Panorama managed configuration to the
suspended
HA peer.
Log into the firewall web interface of the suspended
active
or
Active-Primary
HA peer and select
Device
High Availability
Operational Commands
to
Make local device functional for high availability
.
In the Panorama web interface, select
Panorama
Managed Devices
Summary
, and verify that the device group and template are in sync for HA firewalls. Verify policy rules, objects and network settings on the passive firewall match the active firewall.
Select
Panorama
Managed Devices
Summary
and verify that the
Shared Policy
and
Template
status is
In Sync
for the newly added firewalls.
On the firewall web interface, verify that configuration objects display a green cog, signifying that the configuration object is pushed from Panorama.
Perform your post-migration test plan.
Perform the verification tasks that you devised during the migration planning to confirm that the firewalls work as efficiently with the Panorama-pushed configuration as they did with their original local configuration: see Create a post-migration test plan.