topic Question about aggregrate interfaces in Expedition Discussions

Question about aggregrate interfaces

mss.support — Wed, 16 Jun 2021 21:00:40 GMT

Hi,

Currently I'm migration 3 cisco ASA to one 3220 cluster.

From cisco configuration not exist VCP, simple config with gigaethernets with tagging.

But the customer wants implement aggregate interfaces in palo alto firewall.

My question is, It is possible create the ae grupo and ae interfaces in expedition to migrate push this new configuration to PA?

Thanks

Re: Question about aggregrate interfaces

azuniga — Wed, 16 Jun 2021 21:27:08 GMT

Hello,

Yes this is possible you will need to choose that option within expedition.

Re: Question about aggregrate interfaces

mss.support — Thu, 17 Jun 2021 15:00:29 GMT

Hi Azuniga,

How?, because I see the option. But expedition not give me the option to set up the ip address, zone and virtual router to ae subinterface.

I'm running expedition v1.1.100. Or that option is possible when I performed the merge. Because right now I'm working on cisco config. Until now I do not upload the PANOS base config to expedition because the firewalls is flying to datacenters.

In my case the customer wants use ethenert1/7 and ethernet1/8 as part of aggregate group. I do not see how to do in expedition.

Re: Question about aggregrate interfaces

azuniga — Thu, 17 Jun 2021 15:42:28 GMT

Hello @mss.support

You must be creating it as a layer 2 AE interface. Attached is a screenshot of a layer 3 AE interface.

Re: Question about aggregrate interfaces

mss.support — Thu, 17 Jun 2021 16:13:37 GMT

Hi Azuniga,

Thanks for your answer.

This were my steps.

1. Create the ae1 aggregate group.

2. Create the ethernet1/7 and ethernet1/8.

3. Change configuration from ethernet to aggregate-ethernet and assigned to ae1 group.

4. Create layer3 interface and assigned to VR, ip and tag set up as subinterface in ae1.

This is the correct steps?

And last question, this config is in one of the cisco config, as I mentioned until now I do not have uploaded the PANOS running config base into expedition.

So when I merge the cisco configs of the 3 ASA to single PANOS the ae1 groups do not generate issues ? Because this group will be the same in the 3 cisco ASA configs?.

Thanks

Re: Question about aggregrate interfaces

azuniga — Thu, 17 Jun 2021 16:26:55 GMT

Hello @mss.support

To upload the PAN configuration go ahead and hit import just as you did the Cisco configuration but when you go to the export tab go ahead and hit "set base config" which in this case should use the pan configuration you uploaded and both configurations within the export tab should show up side by side. As for the aggregate interface creation yes you are correct although the tag part is optional.

Re: Question about aggregrate interfaces

mss.support — Thu, 17 Jun 2021 16:34:23 GMT

Thanks Azuniga for all help!!.