Last time I was tasked to migrate my Customer Cortex XDR from Palo Alto Networks to new tenant. Cortex is purely SaaS software, about 5 years ago on-premise management console was decomissioned, previously Palo Alto Networks called it Traps.
How to migrate? Simple when looking into documentation. Just configure new Cortex XDR tenant and migrate endpoints.
I had almost 7 000 endpoints to migrate – servers, workstations, POS computers.
Each endpoint agent has something like distribution id – based on this attribute, agent knows to which Cortex tenant connect to. At initial stage, endpoint has to connect to url distributions.traps.paloaltonetworks.com to obtain its tenant.
Here is a list of required communication overall:
Simple again from theory perspective, what issue I faced. Around half of endpoints migrated quite easily using simple right click on endpoint:
What about rest of endpoints, I faced two main issue:
Agent version
For some reasons (still don’t know why) agents with 7.9.x version didn’t want to migrate without any specific error log. Documentation says that to migrate at least 7.2 version is required. We had to reinstall almost 3 000 endpoints.
Air gapped endpoints
Like wrote above, agent has to talk to Palo Alto Networks cloud (actually they use mostly GCP) to obtain its tenant and then connect to management console. Something called Broker VM should be used – proxy for communications with Cortex cloud. Apart from cloud console, endpoint can be manage from CLI, tool called cytool
I tested below sequence and it worked:)
cytool.exe reconnect force dirtribution_id (force connection to new tenant)
cytool proxy set broker_vm_url:8888 (set up endpoint proxy)Ofcourse at such scale some endpoint management platform is necessary, luckily my Customer is really skilful using SCCM.