topic Re: Importing rules into Expedition from a Firewall managed by Panorama in Expedition Discussions

Importing rules into Expedition from a Firewall managed by Panorama

Tony_Kiser — Fri, 13 Jul 2018 15:40:38 GMT

I'm wanting to do some policy work (app-id migraiton) on a firewalls that is basically 100% managed by Panorama. Don't want to mess with all others yet. How do I get the policy set that's managed in Panorama for just one firewall int Expedition?

Re: Importing rules into Expedition from a Firewall managed by Panorama

Tim_Grossner — Fri, 13 Jul 2018 15:49:19 GMT

You have a device-group for the single firewall that you are wanting to use Expedition for? If not, you'd want to separate that firewall in Panorama to it's own device-group. Expedition talks to Panorama and learns the devices managed by it, but all changes it would need to make would have to be done via Panorama/device-group/templates.

Re: Importing rules into Expedition from a Firewall managed by Panorama

Tony_Kiser — Fri, 13 Jul 2018 15:53:39 GMT

It is (well the HA pair) in its/their own device group. So I'd need to connect to Panaram and pull the whole panarama config, but just work on that device group?

I was wondering if Expedition "understood" device groups.

Re: Importing rules into Expedition from a Firewall managed by Panorama

Tim_Grossner — Fri, 13 Jul 2018 16:02:04 GMT

So I'd need to connect to Panaram and pull the whole panarama config, but just work on that device group? - correct.

I was wondering if Expedition "understood" device groups. - it does. You create a project, import Panorama, and the project should inherit the devices Panorama manages...then, when you click on Policies within the project, you should see something like the following in the bottom right corner:

The device-groups should all be there and when you select one, you then only see/operate on the policy for that dev group.

Re: Importing rules into Expedition from a Firewall managed by Panorama

Tony_Kiser — Wed, 18 Jul 2018 15:05:38 GMT

Thanks for that info. OK, on a broader question; is there any documentation yet on actually using Expedition specifically for app-ID adoption on a PA firewall? I remember doing this in a deep-dive lab at Ignite, but didn't save the lab document (bad me). I'm trying to pull it out of memory, but just can't remember the steps. I'm also not finding anything but the user guide, and the admin guide, which are less than helpful.

Anyone know of actual step by step help for this?

Re: Importing rules into Expedition from a Firewall managed by Panorama

Tim_Grossner — Wed, 18 Jul 2018 15:13:40 GMT

Would this help? 😉

https://drive.google.com/open?id=1OGcCqihVP1O81q5eZb4NMIMDAGv585JV

Re: Importing rules into Expedition from a Firewall managed by Panorama

Tony_Kiser — Wed, 18 Jul 2018 15:22:42 GMT

Dude... you are the man! lol