topic Unused ASA Services after Expedition import in Expedition Discussions

Unused ASA Services after Expedition import

Thom199 — Mon, 14 Jun 2021 21:31:24 GMT

Team,

This is my first time to post a question and this is my first experience with Palo devices. I am running Expedition version 1.1.98. What I am trying to do is take my existing ASA configuration and eventually merge it with a base Palo (9.1) configuration that I will eventually load on a new Palo 820. I created a project, imported my palo base configuration, and imported my ASA configuration via txt. Then I went through and started correcting the invalid and duplicated objects. While there are no more "red" counters in my statistics I am seeing that Expedition has listed all 88 of the services as "unused". Is this normal? I suppose that the services would be replaced by Palo services but since this is my first go around I am not sure. Thanks for your help.

Re: Unused ASA Services after Expedition import

azuniga — Thu, 24 Jun 2021 18:07:31 GMT

Hello @Thom199

Thanks for reaching out to the community and welcome. Yes it is common to have services as unused as our services are used in multiple areas and are referenced to a single service where if you import a Cisco ASA configuration you might have the same service referenced multiple times using multiple objects. Expanding upon that if you are referencing BGP over TCP 179 you may have 3 services being referenced within your configuration, where as in PAN we reference that as 1 single service so this also helps in cleaning up your firewall I hope that makes sense.

Here is the YouTube video on a Cisco ASA migration that might help you with your migration.

https://www.youtube.com/playlist?list=PLD6FJ8WNiIqVez8EBeoyRsnQcKTA5FuZ-

Re: Unused ASA Services after Expedition import

Thom199 — Fri, 02 Jul 2021 01:58:51 GMT

Thank you very much. Your explanation is very helpful.