topic Re: Migrating a ScreenOS Object that contains both TCP and UPD ports in Expedition Discussions

Migrating a ScreenOS Object that contains both TCP and UPD ports

chtoh82 — Fri, 28 Feb 2020 08:20:48 GMT

Hi,

I had recently did a migration via expedition from ScreenOS (6.3.0r25.0) to PANOS, ScreenOS supports both TCP and UDP ports within a single object. When the configuration gets ported over to PANOS, Expedition creates one TCP service and one UDP service, then adds both of them into a Service Group. This is because PANOS does not support both TCP and UDP ports within a single object.

However, Expedition chooses only the TCP service object for the security policy instead of choosing the Service Group, this should not be the expected behaviour. Hence, could I check if this is a bug? Thanks.

Re: Migrating a ScreenOS Object that contains both TCP and UPD ports

dgildelaig — Fri, 28 Feb 2020 08:50:03 GMT

Thanks for pointing this out.

This may be a missing control in the Expedition parser. Could you contact us to fwmigrate@paloaltonetworks.com to deeper inspect this case (potentially with a sample of the configuration) so we can resolve it?

Thanks

Re: Migrating a ScreenOS Object that contains both TCP and UPD ports

chtoh82 — Fri, 28 Feb 2020 10:00:19 GMT

Hello, thanks for the reply. I've contacted the email aliase. Apologies, I couldn't provided the screen os config as it is confidential to the customer. Thanks!