topic Re: Migrate Security Rules in multiple device groups with Expedition in Expedition Discussions

Migrate Security Rules in multiple device groups with Expedition

Jean-Bruno — Wed, 27 May 2020 20:15:13 GMT

Hello,

I have a policy rule imported from a Juniper with one Vsys.

I'd like to split the rules and migrate them in different Device Group (Multiple VSYS) in a Panorama

It seems that Expedition only give the possibilty to export the rules in one Device group in the Mapping tab. So if rules belong to multiple device, the only solution i ve found is to move the security policies to one Device group and then to move them with Panorama console in the other Device groups.

Is there a trick to get more granularity in the Device group Export?

Thanks for your help

Re: Migrate Security Rules in multiple device groups with Expedition

lychiang — Thu, 28 May 2020 03:45:09 GMT

Hi Jean-Bruno,

If the security policy is shared by all device group, you can moved them to shared in Expedition. If they are not shared, you could try export the merged config from Expedition and perform "load config partial" in Panorama CLI to load the security policy to the corresponding device groups https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-cli-quick-start/use-the-cli/load-configurations/load-a-partial-configuration

use the below move rules function in Panorama GUI to move rules from one device group to another device group https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/manage-firewalls/manage-device-groups/move-or-clone-a-policy-rule-or-object-to-a-different-device-group.html

Hope this helps!

Re: Migrate Security Rules in multiple device groups with Expedition

Jean-Bruno — Thu, 28 May 2020 17:45:50 GMT

i thought there was a button somewhere to move rule among DG in Expedition. Maybe a feature to add?;)

I'll move the rules manually then from Panorama GUI.

Thank for your reply

Re: Migrate Security Rules in multiple device groups with Expedition

lychiang — Thu, 28 May 2020 18:26:29 GMT

There is a function in export tab if you are converting from multi-vsys or multiple firewalls to multiple device groups, where you can drag and drop the left side's security policy from different vsys to the corresponding device groups on the right side and merge the config. But In your scenario , you are converting from single vsys to multiple device groups, so you won't be able to drag and drop the security policy to different device groups. Please see attached screenshot:

Re: Migrate Security Rules in multiple device groups with Expedition

Jean-Bruno — Thu, 28 May 2020 18:42:30 GMT

Yes i agree, but there is no way to clone the rules from one device group to another in Expedition.

And when it is dragged to the right, left content gets empty. So no real solution in my scenario. Panorama GUI is the way to go

Thanks

Re: Migrate Security Rules in multiple device groups with Expedition

dgildelaig — Thu, 04 Jun 2020 14:45:21 GMT

You are right. We have an option to move a rule to Shared, but we did not implement a feature to move/clone a rule between different DGs/VSys.

We will take note of this need and add it to our list of functionalities we would like to provide in Expedition 2.0, which it is currently under development.