topic Re: Expedition version 4 - SRX to Palo Alto migration issue in Expedition Discussions

Expedition version 4 - SRX to Palo Alto migration issue

shinojpdr — Sat, 19 Jan 2019 05:25:50 GMT

I am using Expedition Version4.

SRX JunOs configs to PanOs migration, only few interfaces, zones and one VR(logging-vr) are getting migrated. Tool doesn't detect any security groups, address books, security policies...etc. We have hundreds of security groups in one box, which are configured for different customers. All the security groups need to be migrated one by one.

Toatally I am unable to migrate the whole SRX configuration to Palo alto, except few base configs of the box.

Any help would be greatly appreciated.

Re: Expedition version 4 - SRX to Palo Alto migration issue

dgildelaig — Mon, 21 Jan 2019 08:42:20 GMT

Hi,

Please, send us a private message to fwmigrate at paloaltonetworks dot com and we will check more in detail this case. We may need to get access to the configuration to verify where the issue in the SRX parser may be, if the problem is that the parser is not supporting your type of config.

We will update this thread afterwards.

Re: Expedition version 4 - SRX to Palo Alto migration issue

shinojpdr — Mon, 28 Jan 2019 06:29:00 GMT

Hi dgildelaig,

I have shared the sample srx configuration file with fwmigrate at paloaltonetworks dot com. Please check and let me know if any issues with that configuration.

Re: Expedition version 4 - SRX to Palo Alto migration issue

dgildelaig — Mon, 28 Jan 2019 15:27:41 GMT

Make sure that you do not modify the XML structure, as we have created the parsers to work with specific schemas for each vendor.

If you provide the XML subcontent (removing some of the parent XML elements) it won't comply with the SRX schema, and the parser won't be able to load the content correctly.

Does it make sense?

Re: Expedition version 4 - SRX to Palo Alto migration issue

shinojpdr — Tue, 29 Jan 2019 05:29:49 GMT

Hi dgildelaig,

We have multiple configuration groups under a single Juniper SRX box (like vsys in Netscreen) which are configured for different customers. The configuration which I have shared is the sample configuration of customer1 and the configuration group name is Customer-1. The command I have used to get that configuration is 'show configuration groups Customer-1 | display xml | no-more' . When we try to import the output of 'show configuration groups Customer-1 | display xml | no-more' in to the expedition tool import is not happening and we are getting 'Invalid XML' error message (XML is invalid. Tip:Remove attributes from configuration tag ).

Even if I try to migate the entire SRX box configuration (show configuration | display xml | no-more), some basic componets are only getting migrated.

Hope it make sense

Re: Expedition version 4 - SRX to Palo Alto migration issue

dgildelaig — Tue, 29 Jan 2019 09:21:46 GMT

I checked in our email, and I could not find a config attached to any email related to SRX.

Could you please send it again and refer to this Forum Thread in the email? Thanks

Re: Expedition version 4 - SRX to Palo Alto migration issue

shinojpdr — Tue, 29 Jan 2019 19:00:46 GMT

Hi dgildelaig,

Sent the srx config file to your email id. Please check.

Re: Expedition version 4 - SRX to Palo Alto migration issue

MikeCS1 — Wed, 25 May 2022 08:09:55 GMT

I have a similar problem converting SRX to PAN-OS. Only got interfaces , no security zones, most service and service groups, but that's it, nothing else. I am using junos 12.3 and expedition 1.2.21

Re: Expedition version 4 - SRX to Palo Alto migration issue

KrishnanR — Tue, 07 Jun 2022 07:25:28 GMT

I have the same issue. Did you resolve it ?

Re: Expedition version 4 - SRX to Palo Alto migration issue

randymiller — Mon, 13 Mar 2023 14:29:20 GMT

Was there ever a resolution mentioned about this? I'm encountering the same issue. I only have interface data when importing the xml into Expedition.

Re: Expedition version 4 - SRX to Palo Alto migration issue

lychiang — Mon, 13 Mar 2023 16:35:29 GMT

Hi @randymiller Please open a TAC case and attache your SRX config in the case, please send your TAC case# to fwmigrate@paloaltonetworks.com

Re: Expedition version 4 - SRX to Palo Alto migration issue

randymiller — Mon, 13 Mar 2023 17:11:25 GMT

Thanks, but I appear to have resolved my issues using the below article.

https://live.paloaltonetworks.com/t5/expedition-articles/juniper-srx-sanitize-configuration-before-migrate/ta-p/215853

Re: Expedition version 4 - SRX to Palo Alto migration issue

Logix-Kunal — Mon, 22 Jan 2024 05:07:57 GMT

hi Team,

I am getting the error while doinf the migration.

" rulebase -> security -> rules -> Lync-Client-to-client 'Lync-Client-to-client' is already in use
rulebase -> security -> rules -> Capitaline 'Capitaline' is already in use
rulebase -> security -> rules -> ADMIN_ACCESS 'ADMIN_ACCESS' is already in use
rulebase -> security -> rules -> Telesoft 'Telesoft' is already in use
rulebase -> security -> rules -> Netapp_Storage 'Netapp_Storage' is already in use
rulebase -> security -> rules -> AAA_Radius 'AAA_Radius' is already in use
rulebase -> security -> rules -> AVAYA_CUM_Manager 'AVAYA_CUM_Manager' is already in use"

above is error how to mitigate this?

Regards

Kunal S

Re: Expedition version 4 - SRX to Palo Alto migration issue

dpuigdomenec — Mon, 22 Jan 2024 11:35:27 GMT

Hi @Logix-Kunal

Thanks for reaching out.

Based on the shared log it looks like your device is complaining due to having rules with the same name. You can not commit duplicated names to your device.

You can verify in Expedition if you have duplicated rule names using filters and/or the initial dashboard section (column duplicated).

Hope this helps,

David

Re: Expedition version 4 - SRX to Palo Alto migration issue

Logix-Kunal — Mon, 22 Jan 2024 11:42:00 GMT

Can you share the example forthe same

Re: Expedition version 4 - SRX to Palo Alto migration issue

dpuigdomenec — Mon, 22 Jan 2024 12:02:03 GMT

Hi @Logix-Kunal,

Please have a look at below video where it goes over the clean-up of a configuration.

In your case you will see in your Dashboard a red number on the column Security Rules > Duplicated.

Let me know if you need anything else,

Best regards,

David

Re: Expedition version 4 - SRX to Palo Alto migration issue

Anthony.ruggiero — Mon, 24 Feb 2025 21:05:38 GMT

Just FYI in addition to following this article I wound up having to remove the ssl decryption, IDP configuration and application-services from all of the policies. After that it was able to import fine. It seemed to have an issue mapping some of the advanced UTM policies over to the palo alto security groups. I manually configured those afterwards.