©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
233
Troubleshooting
Replace
an
RMA
Firewall
Replace
an
RMA
Firewall
To
minimize
the
effort
required
to
restore
the
configuration
on
a
managed
firewall
involving
a
Return
Merchandise
Authorization
(RMA),
replace
the
serial
number
of
the
old
firewall
with
that
of
the
new/replacement
firewall
on
Panorama.
To
then
restore
the
configuration
on
the
replacement
firewall,
either
import
a
firewall
state
that
you
previously
generated
and
exported
from
the
firewall
or
use
Panorama
to
generate
a
partial
device
state
for
managed
firewalls
running
PAN
‐
OS
5.0
and
later
versions.
By
replacing
the
serial
number
and
importing
the
device
state,
you
can
resume
using
Panorama
to
manage
the
firewall.
Partial
Device
State
Generation
for
Firewalls
When
you
use
Panorama
to
generate
a
partial
device
state,
it
replicates
the
configuration
of
the
managed
firewalls
with
a
few
exceptions
for
Large
Scale
VPN
(LSVPN)
setups.
You
create
the
partial
device
state
by
combining
two
facets
of
the
configuration
on
a
managed
firewall:
Centralized
configuration
managed
by
Panorama—Panorama
maintains
a
snapshot
of
the
shared
policies
and
templates
that
it
pushes
to
firewalls.
Local
configuration
on
the
firewall—When
a
configuration
change
is
committed,
each
firewall
sends
a
copy
of
its
local
configuration
file
to
Panorama.
Panorama
stores
this
file
and
uses
it
to
compile
the
partial
device
state
bundle.
Panorama
does
not
store
the
device
state;
you
generate
it
on
request
using
the
CLI
commands
listed
in
Before
Starting
RMA
Firewall
Replacement
The
managed
firewall
(that
was
replaced)
must
have
been
on
PAN
‐
OS
5.0.4
and
later
version.
Panorama
cannot
generate
the
device
state
for
firewalls
running
older
PAN
‐
OS
versions.
Record
the
following
details
about
the
old
firewall:
In
an
LSVPN
setup,
the
partial
device
state
bundle
that
you
generate
on
Panorama
is
not
the
same
as
the
version
that
you
export
from
a
firewall
(by
selecting
Device > Setup > Operations
and
clicking
Export device state
).
If
you
manually
ran
the
device
state
export
or
scheduled
an
XML
API
script
to
export
the
file
to
a
remote
server,
you
can
use
the
exported
device
state
in
your
firewall
replacement
workflow.
If
you
did
not
export
the
device
state,
the
device
state
that
you
generate
in
the
replacement
workflow
will
not
include
the
dynamic
configuration
information,
such
as
the
certificate
details
and
registered
firewalls,
that
is
required
to
restore
the
complete
configuration
of
a
firewall
functioning
as
an
LSVPN
portal.
See
for
more
information.
