topic Re: Lost Multi-Vsys policies after optimization within expedition in Expedition Discussions

Lost Multi-Vsys policies after optimization within expedition

Chacko42 — Mon, 30 Nov 2020 14:05:03 GMT

Hi Community,

I currently got a interesting case:

Existing PA5250 with 6 vsys instances and I want to cleanup a few unused objects, do multi-tagging and so on.

After doing the optimization and after generating output, I've lost all policies - I was lucky, to check the config before importing.

I thougt, maybe a few changes where to much, so I created a new project and only imported and exported the config - same behavior.

My input xml with 5 MB is shrunk to 2,5M optimized - with loosing all policies.

Does anyone have an idea, if multi-vsys is supported with expedition or what might get wrong?

Newest expedition with 1.1.87 in use

Best Regards

Chacko

Re: Lost Multi-Vsys policies after optimization within expedition

lychiang — Mon, 30 Nov 2020 17:56:48 GMT

@Chacko42 ,

Expedition do supports multi-vsys configuration, if it does not work for you, please open a TAC case and upload your firewall configuration there, please send an email to fwmigrate@paloaltonetworks.com to inform us about the case#.

Re: Lost Multi-Vsys policies after optimization within expedition

Chacko42 — Tue, 01 Dec 2020 07:28:12 GMT

Hi @lychiang,

just to verify: I can import a multi-vsys config, go to objects, click on remove all unused and then go to export and click on generate config.

Is that the supposed way to do that or am I missing a step?

Best Regards

Chacko

Re: Lost Multi-Vsys policies after optimization within expedition

lychiang — Tue, 01 Dec 2020 17:19:29 GMT

Hi @Chacko42 ,

That's the correct step, after you removed the unused objects and you will go to export, make sure the base file name matched the PAN-OS configuration file you imported, then click on "Generate XML & SetOutput", you can then download the xml or download the zip file , in the zip file, there is a file named MT-*-pretty.xml, that xml file will be more readable for you, it is the same contents if you just download the xml file.

Re: Lost Multi-Vsys policies after optimization within expedition

Chacko42 — Tue, 01 Dec 2020 18:19:41 GMT

Alright, so the procedure is the same as with single-vsys.

TAC case is created: #01662682

Re: Lost Multi-Vsys policies after optimization within expedition

lychiang — Tue, 01 Dec 2020 18:31:04 GMT

@Chacko42 I am not seeing any configuration file attached to the case, can you please upload your running configuration to the case.

Re: Lost Multi-Vsys policies after optimization within expedition

Chacko42 — Tue, 01 Dec 2020 18:33:38 GMT

Please find the uploaded running config in the case files

Re: Lost Multi-Vsys policies after optimization within expedition

lychiang — Tue, 01 Dec 2020 19:38:28 GMT

@Chacko42 I verified your configuration,I did not see any policy was missing after export the configuration, you can try export the config from the expedition and create a new project and import the exported configuration and see if you seeing the security policies.