topic Cisco ASA to PA conversion some of the APIs failed with "is not a valid reference" error in Expedition Discussions

Cisco ASA to PA conversion some of the APIs failed with "is not a valid reference" error

tusharj — Tue, 07 Apr 2020 14:58:19 GMT

Hi All, i am doing migration from Cisco ASA to PA and in using Expedition tool at the last step where API Output Manager to push/send API some of the APIs failed to push with error '\...\is not a valid reference' error, a couple of APIs are successful (ex NAT, tag, VSYS) but address, address groups, security rules, service groups failed..

Pls advice, appreciate the help.

Regards,

Tushar

Re: Cisco ASA to PA conversion some of the APIs failed with "is not a valid reference" err

lychiang — Tue, 07 Apr 2020 16:04:44 GMT

Hi Tusharj,

Please send a e-mail to fwmigrate@paloaltonetworks.com, the team can help you on this issue.

Thank you!

Re: Cisco ASA to PA conversion some of the APIs failed with "is not a valid reference" err

dgildelaig — Wed, 08 Apr 2020 14:21:48 GMT

I also agree that the best would be to contact us via email to check the ASA config in more detail.

It is strange that you have a reference to an object called "..."

Was the original config file cleaned in any way?

Re: Cisco ASA to PA conversion some of the APIs failed with "is not a valid reference" err

tusharj — Wed, 15 Apr 2020 14:23:45 GMT

Hi,

i ended up using xml import since APIs were failing, even then i got bunch or errors/warnings in commit validations, one thing i noticed and may be a bug is that there was a tag added as 'merged' by the expedition tool on some of the objects, i simply needed to remove that tag and that issue was resolved.

Tushar

Re: Cisco ASA to PA conversion some of the APIs failed with "is not a valid reference" err

dgildelaig — Tue, 21 Apr 2020 08:04:29 GMT

Thanks for reporting this.

Could you let us know which version of Expedition were you using while doing the Export of the XML?

Thanks again