Palo Alto VM firewall

[chris11256]

Morning,

 

We have a Palo Alto VM-300 which has been running well for a few months now. This summer we're doing a server refresh and replacing our old ESX servers. According to Palo Alto the VM firewall doesn't support Vmotion, but does anyone know what happens if you do vmotion the firewall(either while running or shut down)?

 

As the firewall is going to have to move hosts for the server refresh, I just need to find out whether doing so will break it completely.

 

Thanks,

 

Chris

[Davit2005]

Altenatively what about building new,migrate the config accross, deactivating old and re-activate new. Maybe your PaloAlto support/reseller could advise best/supported method.

 

I've used Veeam before now to restore to different hardware in a LAB but never done this in a production environment.

[chris11256]

Altenatively what about building new,migrate the config accross, deactivating old and re-activate new. Maybe your PaloAlto support/reseller could advise best/supported method.

 

I've used Veeam before now to restore to different hardware in a LAB but never done this in a production environment.

 

 

Thanks, I think that might be better than completely breaking it in Vmotion

[TechMonkey]

Sorry to jump on your thread but could anyone explain why a VM wouldn't support VMotion? My understanding was the VM wouldn't know and would be self contained so as to make VMotion possible. I can't think of anything a VM would know about that would break by it moving.

[chris11256]

Sorry to jump on your thread but could anyone explain why a VM wouldn't support VMotion? My understanding was the VM wouldn't know and would be self contained so as to make VMotion possible. I can't think of anything a VM would know about that would break by it moving.

 

Thats the interesting thing! It just says in Palo Alto documentation that the virtual firewall doesn't support vmotion. It doesn't say what happens if you do and no one on our reseller support team knows.

[chris11256]

Update from me.

 

Have done some digging on the Palo Alto community forum and some people say that've had no problem at all with Vmotion, others have had the license invalidated by the move. Apartantly it depends if the VM UUID changes during the move.

[Davit2005]

What they are probably suggesting is that vMotion cannot be used as a method of redundancy or High Availabilty. But yes this is probably why Veeam should work because it is an as is backup.

 

But it would be better to build a new and import the config in my opinion as you will end up with 2 devices on same network sharing same MAC addresses if you do a backup restore of the VM otherwise.

Edited June 20, 2019 by Davit2005