Focus

Panorama Administrator's Guide

Prepare Panorama for Migration - Checklist and Prerequisites

Table of Contents

Prepare Panorama for Migration - Checklist and Prerequisites

Ensure a smooth device transition by reviewing this checklist and confirming all technical prerequisites are met.

Review and complete this pre-migration checklist to ensure that you meet all the prerequisites before transitioning managed devices to the new Panorama platform. This approach establishes the necessary safeguards to minimize downtime and ensures a smooth device transition.

Preparation and Environment Setup

Establish a clear date, time, and duration for the migration. Schedule a Maintenance Window to account for migration, intermediate version upgrades, and potential rollback activities.
Ensure no administrative actions, either manual or via third-party tools occur during the maintenance window to maintain configuration consistency.
When migrating between appliances that do not support the same PAN-OS version (such as moving from an M-500 to an M-700), an intermediate virtual appliance that supports both versions acts as a temporary bridge. Therefore, ensure your intermediate virtual appliance is fully installed, powered on, running the target PAN-OS version, and reliably connected to the network.
Ensure the target Panorama or the intermediate virtual appliance has unrestricted access to the source Panorama and all managed devices.
Compile a complete list of third-party tools, such as SNMP, Syslog, API etc that interact with Panorama, including their IP addresses and connection types.
Confirm that all necessary firewall policies are in place to allow communication between the target Panorama, managed devices, and external tools.

Target Appliance Readiness

Complete physical installation and network cabling for the new appliance.
Upgrade the PAN-OS version and dynamic contents of the target Panorama to match the source Panorama.
Install all plugins on the new appliance to match those currently used on the source.
Run debug completion-cache show and disable the cache if necessary to ensure clean configuration loading.
Ensure that the target appliance is licensed for device management and support.
Plugin licenses need to be migrated (Cloud Services).

Backup and Configuration Management

Capture a fresh set of running configurations in XML format and Tech Support Files (TSF) from the source Panorama and all Log Collectors.
Export the MongoDB database from the source Panorama if your deployment requires an SD-WAN migration. This is necessary to ensure all SD-WAN specific state and configuration data is preserved and transferred properly.
Take a baseline configuration backup and TSF of the target Panorama before beginning the migration.
Document any necessary changes required for the target environment.

Transition to a Different Panorama Model

Migrate Panorama SC3 Certificates During Appliance Migration