topic Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template in Expedition Discussions

ASA to Panoarama DG/Template - Merge shows things for most DGs/Templates

justamoment — Fri, 12 Jun 2020 20:58:27 GMT

I'm attempting my first migration of an ASA to one of my Panorama-managed clusters (1 A/P cluster in a DG/Template) and am following the recent YouTube tutorial for doing so. When I get to the merge step, the API results include a lot items for my other DGs/Templates. I've tried Atomic & Subatomic and it pretty much looks the same (I didn't do a line-for-line comparison by eyeballing the 2 looks identical).

Is this something of concern? Are there certain things to be on the lookout for?

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

lychiang — Fri, 12 Jun 2020 22:34:27 GMT

@justamoment

Atomic & Subatomic should looks different , for example : If you are pushing the rules via API calls, when select "Atomic" and click on "Generate API requests", you will see list of API calls based on device group level , so you will see one API call for all security rules per Device Group and that one API call contains all the security rules. When you switch to "Subatomic" mode , click on"Generate API request" again, you should see one API call per security rule on the Device Group, if you have 100 rules in the device group, then you can click to pick and choose which rules out of 100 you want to push back to your PAN-OS device.

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

justamoment — Mon, 22 Jun 2020 18:30:15 GMT

Sorry for the delay - when I went back to my project it was all messed up - the ASA configuration was completely missing.

I've started over and have been working on it as I have time. Hopefully I'll get back to the merge step today.

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

justamoment — Mon, 13 Jul 2020 18:30:23 GMT

Okay, I've finally been able to get back to this. I'm watching the 9 of 9 tutuorial video and I see something I missed before. I didn't notice that while the Panorama Base Configuration appears on the Export right-pane it includes all DGs/Templates.

How do I limit it to just one DG/Template (we have each firewall or firewall cluster in its own DG/Template)?

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

lychiang — Thu, 16 Jul 2020 21:22:54 GMT

You can drag the zone, object and policy to the corresponding device group on the right , drag the interface to the corresponding template on the right , then go to API export , click "generate API Request" and only push the config for the specific device group , for example , I can search my device group name -DataCenter , and it will shows all API calls related to that device group as attached screenshot. then you can click on each of them to send API calls to the Panorama.

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

justamoment — Mon, 13 Jul 2020 19:08:13 GMT

Oh, that's not what the video said to do - it said to drag everything under vsys1 to the device | vsys1 on the right. Now there is nothing on the left pane for the ASA.

Is there any way to undo this and try again or do I have to start over again?

If I have to start over again, is there any way to make a copy of the project so I don't have to keep re-doing the whole thing?

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

lychiang — Mon, 13 Jul 2020 20:20:48 GMT

The video is for firewall to firewall migration, if you have panorama configuration as base config , you have option to drag and drop the objects to the corresponding device group and template , if you have not yet click on "merge", you can click on "reset" button, if merge is your last action, you can go to right upper corner and click on" Undo last change" Other than those conditions, there is no undo function after you merged the config. If you need to restart a new project, when you start a new project , before you ready to drag and drop the objects from source to base config , you can click on the right upper corner "Save snapshot" , then if something goes wrong, you can then load the saved snapshot back.

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

justamoment — Mon, 13 Jul 2020 20:43:12 GMT

Understood on the video being made for fw-to-fw - I just guessed wrong 😕

Unfortunately, I was fiddling around with the Merge option some more as the post-merge created duplicates so i messed up the last config change and can't undo.

Hopefully, 3rd time's a charm (or is it 4th - I've lost count, lol) 🙂

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

justamoment — Wed, 15 Jul 2020 22:11:21 GMT

Luckily, I had a fairly recent snapshot that I had forgotten I had taken 🙂

So, I'm confused on what I'm supposed to do. Here is what my setup looks like:

So, where do I put each element in the Source pane on the left in the Base Configuration pane on the right?

I tried ASA | Network to Panorama | Template | Firewall (CORE-FW) | Network.

I then hit Merge and go to the API Output Manager and there is no way to select individual DGs:

Do I just check the boxes of the items that are specific to the DG/Template I want to use?

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

lychiang — Wed, 15 Jul 2020 22:55:52 GMT

Hello @justamoment

After you merge the config , when you go to "API output manager", click on "Generate API request" the blue button first, and you should see multiple API calls shown in the screen, Then Try put "Core-FW1" in the search box as attached in the screenshot and you will see all API calls related to Core-FW1 device group and template , you will always needs to push the shared first , the ID column shows the order of your API calls, please follow the order to push individual API calls.

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

justamoment — Thu, 16 Jul 2020 21:17:52 GMT

Am I dragging & dropping the ASA source elements correctly onto the Base Config elements?

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

lychiang — Thu, 16 Jul 2020 21:21:57 GMT

Yes, I believe what you described earlier are correct. Shared objects goes to shared , policy for specific device group go to specific device group. network configuration go to template assume you are using panorama template for the network configuration.

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

justamoment — Thu, 16 Jul 2020 22:27:39 GMT

Okay, so did that, merged, generated API calls (Atomic), searched on CORE-FW1, checked all of the boxes, and sent API requests.

Only a Device Group hiearchy | readonly was processed and it didn't do anything.

I unchecked that one and re-ran and then it sent all of them and I see entries in the config log but when I look at the various GUI pages for that cluster there were no changes made.

Looking through a sub-atomic generate API calls, it looks like the merge didn't do anything. I only see things that were already present on CORE-FW1 and none of the ASA configurations.

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

lychiang — Thu, 16 Jul 2020 22:31:53 GMT

I am not sure why after you merged the config , you still not seeing the merged configs, please make sure the left side ASA config are already empty and you see all the configs are showing up on the right side in the PAN-OS config, then click merge, click regenerate API request , or you can export the config as xml format and verify the config is merged in the xml . If you need further assistant , please write email to fwmigrate@paloaltonetworks.com

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

justamoment — Thu, 16 Jul 2020 22:46:14 GMT

Ugh, I figured out what was going on with the merge - check the boxes! I wasn't noticing that when I did the drag and drop of each item it wasn't also checking the box while I did it. <sigh>

Okay, so now I have what looks like a valid generate API requests output.

You mentioned earlier to send the shared items first. How do I do that? I searched on shared and received 185 pages at 50 entries per page.

After this question, if I have further issues I'll switch to email.

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

lychiang — Fri, 17 Jul 2020 03:23:45 GMT

If you have objects that's in shared , for example address objects or service object that is in shared besides the pre-defined one, you will need to push those shared address/service objects before you push the device group level objects , if you don't have any thing in shared , you don't need to push the shared objects. when you go to objects, you can see the object is in shared or not, if it's in shared , it will show vsys name as "shared" instead of vsys1 or your device group name. Hope this is clear.

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

justamoment — Thu, 16 Jul 2020 23:08:33 GMT

Understood but if I have shared objects, how do i find those to send those API calls first?

(I did some edits and then removed them because I wasn't looking in the right place)

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

lychiang — Thu, 16 Jul 2020 23:19:31 GMT

1. If you are asking how to move the address objects from vsys1 to shared, you can right click on the object and select "Convert to Shared" as shown in screenshot:

2. How to push those shared objects in API calls, you can go to "Address" section and search "shared", you will see API calls for pushing shared address objects list as below.

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

justamoment — Fri, 17 Jul 2020 07:53:24 GMT

So far things you've pointed out have helped immensely. After a number of iterations I'm getting a better handle on how this all works.

I still have at least one more iteration as I've been getting a lot of send API command errors. It would be nice if the sends would just continue on and report any errors found rather than just stopping at the first one.

Re: ASA to Panoarama DG/Template - Merge shows things for most DGs/Template

justamoment — Fri, 17 Jul 2020 07:57:56 GMT

I spoke too soon - I just tried to commit to Panorama to save my work until morning and I'm gettting 30 validation errors. I think I might know why it's happening though. It looks like all of them are objects that disappeared. I bet I didn't update Panorama correctly in Expedition after recent changes. I'll have to re-watch that video and test it out.