Migrate a Firewall to Panorama Management

Plan the migration.
See the checklist in Plan the Transition to Panorama Management.
Add the firewall as a managed device.
Add a Firewall as a Managed Device:
Log in to Panorama, select
Panorama
Managed Devices
Summary
and click
Add
.
Enter the serial number of the firewall and click
OK
.
If you will import multiple firewall configurations, enter the serial number of each one on a separate line. Optionally, you can copy and paste the serial numbers from a Microsoft Excel worksheet.
Select
Commit
Commit to Panorama
and
Commit
your changes.
Set up a connection from the firewall to Panorama.
Log in to the firewall, select
Device
Setup
, and edit the Panorama Settings.
In the
Panorama Servers
fields, enter the IP addresses of the Panorama management server.
Click
OK
and
Commit
.
Import the firewall configuration into Panorama.
If you later decide to re-import a firewall configuration, first remove the firewall device groups and template to which it is a member. If the device group and template names are the same as the firewall hostname, then you can delete the device group and template before re-importing the firewall configuration or use the
Device Group Name Prefix
fields to define new names for the device group and template created by the re-import. Additionally, firewalls don’t lose logs when you remove them from device groups or templates.
From Panorama, select
Panorama
Setup
Operations
, click
Import device configuration to Panorama
, and select the
Device
.
Panorama can’t import a configuration from a firewall that is assigned to an existing device group or template.
(
Optional
) Edit the
Template Name
. The default value is the firewall name. You can’t use the name of an existing template or template stack.
(
Optional
) Edit the
Device Group
names. For a multi-vsys firewall, each device group has a vsys name by default, so add a character string as a Device Group Name Prefix for all the device groups. Otherwise, the default value is the firewall name. You can’t use the names of existing device groups.
The
Import devices' shared objects into Panorama's shared context
check box is selected by default, which means Panorama compares imports objects that belong to the Shared location in the firewall to Shared in Panorama. If an imported object is not in the Shared context of the firewall, it is applied to each device group being imported. If you clear the check box, Panorama copies will not compare imported objects, and apply all shared firewall objects into device groups being imported instead of Shared. This could create duplicate objects, so selecting the check box is a best practice in most cases. To understand the consequences of importing shared or duplicate objects into Panorama, see Plan how to manage shared settings.
Select a
Rule Import Location
for the imported policy rules:
Pre Rulebase
or
Post Rulebase
. Regardless of your selection, Panorama imports default security rules (intrazone-default and interzone-default) into the post-rulebase.
If Panorama has a rule with the same name as a firewall rule that you import, Panorama displays both rules. Delete one of the rules before performing a Panorama commit to prevent a commit error.
Click
OK
. Panorama displays the import status, result, details about your selections, details about what was imported, and any warnings. Click
Close
.
Select
Commit
Commit to Panorama
and
Commit
your changes.
Push the configuration from Panorama to the newly added device.
To prevent duplicate rule or object names, push the device group configuration from Panorama to the firewall to avoid commit errors.
This step is required to successfully migrate firewall management to the Panorama management server. Failure to perform this step successfully causes configuration errors and commit failures.
Log in to the Panorama Web Interface and select
Panorama
Setup
Operations
and click
Export or push device config bundle
.
Click
Export or push device config bundle
, select the
Device
from the drop-down menu, and click
OK
.
Select the
Device
from which you imported the configuration, click
OK
, and click
Push & Commit
. Panorama pushes the bundle and initiates a commit on the firewall.
Click
Close
after the push has committed successfully.
Launch the Web Interface of the firewall and ensure that the configuration has been successfully committed. If not,
Commit
the changes locally on the firewall.
On the Panorama web interface, Select
Panorama
Managed Devices
Summary
, and verify that the device group and template stack are in sync for the passive firewall. Verify policy rules, objects and network settings on the passive firewall match the active firewall. On the firewall web interface, verify that configuration objects display a green cog ( ), signifying that the configuration object is pushed from Panorama.
Select
Commit
Commit to Panorama
and
Commit
your changes.
Fine-tune the imported configuration.
In Panorama, select
Panorama
Config Audit
, select the
Running config
and
Candidate config
for the comparison, click
Go
, and review the output.
Update the device group and template configurations as needed based on the configuration audit and any warnings that Panorama displayed after the import. For example:
Delete redundant objects and policy rules.
Move or Clone a Policy Rule or Object to a Different Device Group.
Move firewalls to different device groups or templates.
Move a device group that Panorama created during the import to a different parent device group: Select
Panorama
Device Groups
, select the device group you want to move, select a new
Parent Device Group
, and click
OK
.
Push the firewall configuration bundle to the firewall to remove all policy rules and objects from its local configuration.
This step is necessary to prevent duplicate rule or object names, which would cause commit errors when you push the device group configuration from Panorama to the firewall in the next step.
In Panorama, select
Commit
Commit to Panorama
and
Commit
your changes.
Select
Panorama
Setup
Operations
and click
Export or push device config bundle
.
Select the
Device
from which you imported the configuration, click
OK
, and click
Push & Commit
. Panorama pushes the bundle and initiates a commit on the firewall.
Push the device group and template configurations to complete the transition to centralized management.
If you are migrating multiple firewalls, perform all the preceding steps—including this one—for each firewall before continuing.
Select
Commit
Commit and Push
and
Edit Selections
in the Push Scope.
Select
Device Groups
and select the device groups that contain the imported firewall configurations.
Select
Merge with Device Candidate Config
,
Include Device and Network Templates
, and
Force Template Values
.
Click
OK
to save your changes to the Push Scope.
Commit and Push
your changes.
Consolidate all the imported firewall configurations.
This step is required if you are migrating multiple firewalls.
After importing all the firewall configurations, update the device groups and templates as needed to eliminate redundancy and streamline configuration management: see Fine-tune the imported configuration. (You don’t need to push firewall configuration bundles again.)
Configure any firewall-specific settings.
If the firewalls will have local zones, you must create them before performing a device group or template commit; Panorama can’t poll the firewalls for zone name or zone configuration. If you will use local firewall rules, ensure their names are unique (not duplicated in Panorama). If necessary, you can Override a Template or Template Stack Value with a firewall-specific value.
Commit and push your changes:
Select
Commit
Commit and Push
and
Edit Selections
in the Push Scope.
Select
Device Groups
, select the device groups you changed, and
Include Device and Network Templates
.
Click
OK
to save your changes to the Push Scope.
Commit and Push
your changes.
Perform your post-migration test plan.
Perform the verification tasks that you devised during the migration planning to confirm that the firewalls work as efficiently with the Panorama-pushed configuration as they did with their original local configuration: see Create a post-migration test plan.