How to remove a Firewall from Panorama
Created On 01/17/19 21:22 PM - Last Modified 05/20/21 02:42 AM
Steps on how to remove a firewall that is managed by Panorama while keeping both the local config and Panorama pushed config on the firewall by merging both during the process.
- Firewall connected/managed by Panorama
Login to Firewall Web UI
- Take a backup
- Device > Setup > Operations
- Click Export Device State (saves local config as well as Panorama Templates and Device Group config)
- Device > Setup > Management
- Click (gear icon) on Panorama Settings
- Click Disable device and Network Template and check the box Import Device and Network Template before disabling, then click OK
- Click Disable Panorama Policy and Objects and check the box Import Panorama Policy and Objects before disabling, then click OK
- Verify all the policies pushed from Panorama are still show on firewall before moving to step 4
- From Device > Setup > Management > Panorama Settings
- Delete the Panorama IP address
Login to Panorama
- Save a copy of the current config for backup
- Panorama > Setup > Operations
- Click "Save named Panorama configuration snapshot"
- Name the config file (today's_date_running_config, before_fw_removal, etc)
- Panorama > Managed Devices > Summary
- Verify the firewall Device State show as Disconnected
- Panorama > Templates
- Remove the device from “template-stack”
- Remove the device from “Template”
- Delete device from "Device Group"
- Panorama > Device Groups which then removes it from Panorama > Managed Devices > Summary
- Delete the firewall from the "Managed Device" device list
- Commit to Panorama
- This article is to remove the standalone firewall from Panorama.
- If a HA (High Availability) Firewall Pair must be removed from Panorama, then "config sync" needs to be disabled, and "commit" must be completed prior to starting the removal process.
- If not, due to HA config sync, one of the firewalls may end up with double policies (one from Panorama and the second from config sync of the Peer). This may result in commit failure