Prepare Panorama for Migration - Checklist and Prerequisites
Ensure a smooth device transition by reviewing this checklist and confirming all
technical prerequisites are met.
Review and complete this pre-migration checklist to ensure that you meet all the
prerequisites before transitioning managed devices to the new Panorama platform. This
approach establishes the necessary safeguards to minimize downtime and ensures a smooth
device transition.
Preparation and Environment Setup
- Establish a clear date, time, and duration for the migration. Schedule a
Maintenance Window to account for migration, intermediate version upgrades, and
potential rollback activities.
- Ensure no administrative actions, either manual or via third-party tools occur
during the maintenance window to maintain configuration consistency.
- When migrating between appliances that do not support the same PAN-OS version
(such as moving from an M-500 to an M-700), an intermediate virtual appliance
that supports both versions acts as a temporary bridge. Therefore, ensure your
intermediate virtual appliance is fully installed, powered on, running the
target PAN-OS version, and reliably connected to the network.
- Ensure the target Panorama or the intermediate virtual appliance has
unrestricted access to the source Panorama and all managed devices.
- Compile a complete list of third-party tools, such as SNMP, Syslog, API etc that
interact with Panorama, including their IP addresses and connection types.
- Confirm that all necessary firewall policies are in place to allow communication
between the target Panorama, managed devices, and external tools.
Target Appliance Readiness
- Complete physical installation and network cabling for the new appliance.
- Upgrade the PAN-OS version and dynamic contents of the target Panorama to match
the source Panorama.
- Install all plugins on the new appliance to match those currently used on the
source.
- Run debug completion-cache show and disable the cache if
necessary to ensure clean configuration loading.
- Ensure that the target appliance is licensed for device management and
support.
- Plugin licenses need to be migrated (Cloud Services).
Backup and Configuration Management
- Capture a fresh set of running configurations in XML format and Tech Support
Files (TSF) from the source Panorama and all Log Collectors.
- (SD-WAN Only) Export the MongoDB database (mongodump) from the source
Panorama to an external SCP server if your deployment requires an SD-WAN
migration. This is necessary to ensure all SD-WAN specific state and
configuration data is preserved and transferred properly.
- Take a baseline configuration backup and TSF of the target Panorama before
beginning the migration.
- Document any necessary changes required for the target environment.
