topic Re: Unused objects actually used by NAT in Expedition Discussions

Unused objects actually used by NAT

Tony_Kiser — Mon, 14 Oct 2019 15:34:10 GMT

I am using Expedition to remove unused objects from firewalls via a partial config import. What I ran into is the tool removed an unknown number of objects that, while not used by a security policy, they are in fact used by a NAT policy! Because of this I was only able to import services, service groups, and address groups. Importing the new, "smaller" address list won't allow a commit because of the NAT policies that are pointing to objects that Expedition removed.

Has anyone else seen this, or have any info on why this is happening?

Re: Unused objects actually used by NAT

dgildelaig — Tue, 15 Oct 2019 08:21:09 GMT

Which version of Expedition are you using?

Would it be possible to share the configuration with us via fwmigrate email to verify the causes for this issue?

Re: Unused objects actually used by NAT

Tony_Kiser — Wed, 16 Oct 2019 14:19:37 GMT

I just updated, but was at 1.1.35. is that e-mail fwmigrate@paloaltonetworks dot com?

Re: Unused objects actually used by NAT

Tony_Kiser — Wed, 06 Nov 2019 18:20:21 GMT

Updated to the latest version and still the same problem! any help would be great!