If you have already deployed Palo Alto Networks firewalls
and configured them locally, but now want to use Panorama for centrally
managing them, you must perform pre-migration planning. The migration
involves importing firewall configurations into Panorama and verifying
that the firewalls function as expected after the transition. If
some settings are unique to individual firewalls, you can continue accessing
the firewalls to manage the unique settings. You can manage any
given firewall setting by pushing its value from Panorama or by
configuring it locally on the firewall, but you cannot manage the
setting through both Panorama and the firewall. If you want to exclude
certain firewall settings from Panorama management, you can either:
Migrate the entire firewall configuration and then, on
Panorama, delete the settings that you will manage locally on firewalls.
You can also Override a Template or Template Stack Value that Panorama
pushes to a firewall instead of deleting the setting on Panorama.
Load a partial firewall configuration, including only the
settings that you will use Panorama to manage.
do not lose logs during the transition to Panorama management.