topic Re: How to handle auto zone? in Expedition Discussions

How to handle auto zone?

rhap4boy — Tue, 12 Mar 2019 05:24:46 GMT

Trying to migrate from Cisco ASA to Palo Alto using Expedition.

These 6 addresses are being flagged as Invalid Addresses.

object network obj_any-01
subnet 0.0.0.0 0.0.0.0
object network obj_any-02
subnet 0.0.0.0 0.0.0.0

object network obj_any-03
subnet 0.0.0.0 0.0.0.0

object network obj_any-04
subnet 0.0.0.0 0.0.0.0

object network obj_any-05
subnet 0.0.0.0 0.0.0.0

object network obj_any-06
subnet 0.0.0.0 0.0.0.0

ject network obj_any-01
nat (inside,dmz) dynamic interface
object network obj_any-02
nat (inside,outside) dynamic obj-0.0.0.0
object network obj_any-03
nat (inside,dmz) dynamic obj-0.0.0.0

object network obj_any-04
nat (dmz,outside) dynamic obj-0.0.0.0
object network obj_any-05
nat (management,outside) dynamic obj-0.0.0.0
object network obj_any-06
nat (management,dmz) dynamic obj-0.0.0.0

What is the correct and efficient way to handle this in expedition without manual entires?

Re: How to handle auto zone?

sjanita — Tue, 12 Mar 2019 09:15:00 GMT

in PanOS - the address 0.0.0.0/0.0.0.0 is an invalid address. You can use the 'search and replace' option to replace those objects with the PanOS predefined address object of 'any' which is equivalent to 0.0.0.0/0

Re: How to handle auto zone?

rhap4boy — Tue, 12 Mar 2019 16:38:57 GMT

Thank you for the quick response.

I don't see the predefined address object of 'any'. Do I simply type it in?

Re: How to handle auto zone?

sjanita — Tue, 12 Mar 2019 20:06:43 GMT

yes you are right, my mistake the 'any' object is only visible with the policy as a predefined option.

There are 2 options to take action:

Create an object: name: any-0.0.0.0 value: 0.0.0.0/0

MEerge the objects using the "same value" of 0.0.0.0/0.0.0.0 and correct the merged object to have a value of 0.0.0.0/0.

Since there are multiple references you can manully find the policies where those objects are referenced and change to the 'any' option in each policy.

Re: How to handle auto zone?

ssparling — Thu, 01 Oct 2020 20:12:30 GMT

Did this end up being resolved by doing this? Can you share how and what you did?