Getting ready to implement this at a manufacturing plant for an automotive OEM this weekend. Watching this makes me feel really comfortable about the implementation. Very well done. Big thanks.
I just wanted to give you a shout out for this tutorial as it worked perfectly in a production environment. I've done several imports of solo firewalls, but never ones before with HA of which many things can go bad. Thank you and subscribed. -Matt
Hi Matt, This is Pure GOLD!! In production networks, most probably, we'd import an firewall/pair of firewalls into the running Panorama which would have already objects configured in it. Can you please post an video on how to fix the duplicate or overlapping IP address issue?
Fantastic videos. I'm mostly watching for the info on templates because in importing all our firewalls into Panorama, we seem to have made a mess of them. But my question is about shared objects. One of those that we imported have a GREAT deal of objects that we imported as shared. You said in the video that, in the reverse situation, we can always move them into the shared objects... can you move them out of shared so that they are no longer shared? How would you do that? Thanks for all the great info.
To avoid a potential outage wouldn't you want to push the bundle to the passive node first? Then failover to the passive node, ensure functionaity as a panorama managed firewall, then push the bundle to the previous active node? Pushing the bundle to both firewalls at once seems a bit risky.
Excellent demo!!.. I have 2 FW in active/passive and currently being managed by an old Panorama.. I would like to move these 2 FW to my new VM based Panorama.. Can you make a quick video on that as well?..
smashed the like button, sweet video. If we are importing HA FWs with multiple virtual systems, is it the same steps? Import one vsys and then the second one?
Hi Matt, When adding devices to Panorama, the primary device is connected but the passive device is shown as disconnected. Can you help me with this problem?
Awesome video. Would these same steps apply to production HA firewalls that have a significant amount of rules and objects? Any caveats? This video helped me import two sets of greenfield devices, but I'd like to get the prod devices in as well. I don't subscribe to too many channels, but I definitely smashed that button on yours. Thanks again.
Yes, absolutely. I’ve used this exact process. Just be mindful about importing the local firewall objects into Panorama’s shared objects. Smaller firewall have limitations on how may shared objects it can store. knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLZUCA4&lang=en_US%E2%80%A9
After following this procedure, my device group was fine but the template values in the local firewall all show overridden and I was not able to revert the interfaces config to template, it references the virtual router and vr was also overridden. Please help.
So even though the devices are in HA and everything is syncing, you still want to manually put both devices into the same device group / template stack?
at 8 mins 40 - you "remove all" from the second firewall template? Why? As this template is not in the renamed template stack? What should actually be done with this second firewall template now - it seems redundant should it just be deleted?
8:19 "cust1-fw01_stack" has the same HA configuration of cust1-fw01.......... but you deleted the HA configuration in each firewall (cust1-fw01 and cust1-fw02)... but you didnt delete the HA configuration in the stack.... Its that ok? I mean, cust1-fw2 is not going to recibe the fw1 HA config with this template?
Serial # for Palo alto firewall on EVE-NG is showing "unknown".. but we need FW serial # to onboard them on Panorama.. How can we achieve that on EVE-NG lab?
you need a base license for vm pan-os and when you import that license serial number will appear on vm. You can request a trial license from Palo Alto Networks
@@qento456 Thanks for your response.. I did request a base license but they won't approve me as I am an existing Palo Alto customer.. But anyway I am think I am good..
