If you have already deployed Palo Alto Networks firewalls and
configured them locally, but now want to use Panorama for centrally managing
them, you must perform pre-migration planning. The migration involves
importing firewall configurations into Panorama and verifying that
the firewalls function as expected after the transition. If some
settings are unique to individual firewalls, you can continue accessing
the firewalls to manage the unique settings. You can manage any
given firewall setting by pushing its value from Panorama or by
configuring it locally on the firewall, but you cannot manage the
setting through both Panorama and the firewall. If you want to exclude
certain firewall settings from Panorama management, you can either:
Migrate the entire firewall configuration and then, on Panorama,
delete the settings that you will manage locally on firewalls. You
can also Override
a Template Setting that Panorama pushes to a firewall instead
of deleting the setting on Panorama.
Load a partial firewall configuration, including only the settings
that you will use Panorama to manage.
Firewalls do not
lose logs during the transition to Panorama management.