How to Configure a High Availability Replacement Device

Gather backup configuration:

Take a backup configuration of the faulty device:

1. Go to  GUI: Device > Setup > Operations > Configuration Management and click "Export device state." The device state contains the configuration for the device.

• To take a backup of a device from Panorama, go to GUI: Panorama > Managed Devices and click "Manage…" under the backups column for the appropriate device.
•  OR you can export the device state bundle to a computer using SCP or TFTP from CLI

> scp export device-state device to username@serverip:/path/

2. For PA-7000 series devices, note the output of the command 

   > show session distribution policy

3. For all platforms, note the output of the following command

   > show system setting jumbo-frame

4. Shut down the faulty unit using the command:

   > request shutdown system

5. Rack the new unit and connect to the unit's Management Interface.

Set up the Basic configuration on the new device:

1. Transfer Licenses. Refer to the following document: How to Transfer Licenses to a Spare Device
2. (Optional) Set the operational mode to match that on the old firewall. A serial port connection is required for this task.
   1. Enter the following CLI command to access maintenance mode on the firewall:

debug system maintenance-mode

2. To boot into the maintenance partition, enter maint during the boot sequence.
3. Select the operational mode as "Set FIPS Mode or Set CCEAL 4 Mode" from the main menu.

3. (Optional) Set the system settings to match the output from the commands in steps (2) and (3) in the previous section.
4. Configure Management Access to the replacement device. Connect only Console and Management interface first.
   1. Access the console and login using the default credentials:
      • Username: admin
      • Password: admin (This may vary depending on the PAN-OS version. Refer documentation for the default password)
   2. Configure the management IP address, netmask, and gateway, as well the DNS and update servers using the following CLI command:

> configure
# set deviceconfig system ip-address <value> netmask <value> default-gateway <value>
# set deviceconfig system dns-setting servers primary 4.2.2.2
# set deviceconfig system update-server updates.paloaltonetworks.com
# commit
# exit

3. Ping a domain to test, for example:

> ping host paloaltonetworks.com

5. Obtain licenses from the license server.

• Go to GUI: Device > Licenses.
• Click Retrieve license keys from the license server.
• Make sure to have a URL filtering license and that the URL filtering is both activated and that the database has been successfully downloaded. Note: If a link "Download Now" is displayed the database has not. downloaded.

6. Install the same GlobalProtect Client and PAN-OS versions on the replacement device as the existing HA Peer

• Install the GlobalProtect Client.
  1. Go to Device > GlobalProtect Client
  2. Download and activate the appropriate version of the client.
• Install PAN-OS.
  1. Go to Device > Software.
  2. Download and install the appropriate image.
• Reboot.

7. Make sure dynamic updates have the same version as the HA peer. If not, then download and install the appropriate version:

8. If the device is being managed from Panorama, replace the old serial number with the new one and commit on the Panorama (After a successful commit, you may need to re-login to the Panorama to see the new serial associated with the correct DG and Template Stack):

> replace device old <Old Serial #> new <New Serial #>
> configure
# commit partial admin <admin_name>

Restore the configuration: