Migrate Log Collectors after Failure/RMA of Non-HA Panorama
If a system failure occurs on a Panorama management server that is not deployed in a high availability (HA) configuration, use this procedure to restore the configuration on the replacement Panorama and restore access to the logs on the Dedicated Log Collectors that it manages. The allowed migration scenarios vary by Panorama management server model:
Panorama virtual appliance
Panorama maintains a ring file that maps the segments and partitions that Dedicated Log Collectors use to store logs. An M-Series appliance in Panorama mode stores the ring file on its internal SSD; a Panorama virtual appliance stores the ring file on its internal disk. When a system failure occurs, a non-HA Panorama cannot automatically recover the ring file. Therefore, when you replace Panorama, you must restore the ring file to access the logs on the Dedicated Log Collectors.
This procedure requires that you backed up and exported your Panorama configuration before the system failure occurred.
Palo Alto Networks recommends deploying Panorama in an HA configuration. The active Panorama peer automatically synchronizes the ring file to the passive peer in an HA configuration, thereby maintaining access to logs on the Dedicated Log Collectors even if you must replace one of the peers.
- Perform initial setup of the new Panorama appliance.
- Set Up the M-Series Appliance or Set Up the Panorama Virtual Appliance based on your needs. If you are setting up a new M-Series appliance, refer to the M-Series Appliance Hardware Reference Guides for instructions on how to rack mount the new M-Series appliance.
Initial Configuration of the M-Series Appliance or Perform
Initial Configuration of the Panorama Virtual Appliance.If the old M-Series appliance used interfaces other than the MGT interface for Panorama services (such as log collection), you must define those interfaces during initial configuration of the new M-Series appliance (PanoramaSetupInterfaces). The Panorama virtual appliance does not support interfaces other than MGT.
- Register Panorama.
- Transfer licenses as follows only if the new Panorama
appliance is the same model as the old appliance. Otherwise, you
must purchase new licenses.
- Log in to the Palo Alto Networks Customer Support web site.
- Select the Assets tab and click the Spares link.
- Click the Serial Number of the new M-Series appliance.
- Click Transfer Licenses.
- Select the old appliance and click Submit.
- Activate a Panorama Support License.
- Activate a firewall management license.
Content and Software Updates for Panorama.The M-500 appliance requires Panorama 7.0 or a later release. M-200 and M-600 appliances require Panorama 8.1. For important details about software versions, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
- Restore the configuration from the old Panorama to the
- Log in to the new Panorama and select PanoramaSetupOperations.
- Click Import named Panorama configuration snapshot, Browse to the backup configuration file, and click OK.
- Click Load named Panorama configuration snapshot, select the Name of the file you just imported, and click OK.
- Select CommitCommit to Panorama and Commit your changes.
- Select PanoramaManaged Collectors and verify
that the Connected column displays a check mark for the Dedicated
Log Collector.If the Dedicated Log Collector doesn’t appear, you must reconfigure it and its Collector Group as described in the next step. Otherwise, skip the following step to Fetch the ring file to restore access to the logs stored on the Dedicated Log Collector.
the Dedicated Log Collector and Collector Group if they are missing
- Access the CLI of the Dedicated Log Collector
and enter the following commands to display the name of its Collector
- Enter the command:
> request fetch ring from log-collector <serial_number>The following error will display:
Server error: Failed to fetch ring info from <serial_number>
- Enter the command:
> less mp-log ms.logThe following error will display:
Dec04 11:07:08 Error: pan_cms_convert_resp_ring_to_file(pan_ops_cms.c:3719): Current configuration does not contain group CA-Collector-GroupIn this example, the error message indicates that the missing Collector Group has the name CA-Collector-Group.
- Configure the Collector Group and assign the Dedicated
Log Collector to it.
> configure # set log-collector-group <collector-group-name> # set log-collector-group <collector-group-name> logfwd-setting collector <serial-number>
- Commit the changes to Panorama but not to the Collector
# commit # exit
- Access the CLI of the Dedicated Log Collector and enter the following commands to display the name of its Collector Group.
- Fetch the
ring file to restore access to the logs stored on the Dedicated
- Access the CLI of the new Panorama.
- Fetch the ring file:
> request fetch ring from log-collector <serial-number>For example:
> request fetch ring from log-collector 009201000343If you don’t know the serial number of the Dedicated Log Collector, log in to its CLI and enter the show system info operational command.
- Commit your changes to the Collector Group.
> commit-all log-collector-config log-collector-group <collector-group-name>
Migrate Logs to a New M-Series Appliance in Panorama Mode
Procedure to migrate logs from a decommissioned M-Series appliance, that is not in a HA pair, to a new M-Series appliance. ...
Migrate Logs to a New M-Series Appliance Model in Panorama ...
Procedure to migrate logs from a decommissioned M-Series appliance in a HA pair to a new M-Series appliance of a different model. ...
Migrate Logs to a New M-Series Appliance in Log Collector M...
Migrate Logs to a New M-Series Appliance in Log Collector Mode If you need to replace an M-600, M-500, M-200 or M-100 appliance in Log ...
Transition to a Different Panorama Model
Transition to a Different Panorama Model When your network requirements change (for example, the logging rate increases), you can migrate the Panorama management server and ...
Migrate from a Panorama Virtual Appliance to an M-Series Ap...
Migrate from a Panorama Virtual Appliance to an M-Series Appliance You can migrate the Panorama configuration from a Panorama virtual appliance to an M-Series appliance ...
Increase Storage on the M-Series Appliance
Increase Storage on the M-Series Appliance After you Perform Initial Configuration of the M-Series Appliance , you can increase log storage capacity of the appliance ...
Set Up the M-Series Appliance
Set Up the M-Series Appliance The M-600, M-500, M-200 and M-100 appliances are high performance hardware appliances that you can deploy in Management Only mode ...
Move a Log Collector to a Different Collector Group
Move a Log Collector to a Different Collector Group M-600, M-500, M-200, M-100 and Panorama virtual appliances can have one or more Log Collectors in ...
Panorama Models Panorama is available as one of the following virtual or physical appliances, each of which supports licenses for managing up to 25, 100, ...