topic Re: SRX to Panorama export mappings question in Expedition Discussions

SRX to Panorama export mappings question

justamoment — Mon, 29 Nov 2021 02:02:55 GMT

I have converted all objects to Shared and this picture illustrates what I think is the correct mappings of each element. Please confirm/correct as necessary. Thanks!

Re: SRX to Panorama export mappings question

justamoment — Mon, 29 Nov 2021 05:01:36 GMT

Well, I tried that and I don't think it's working correctly.

I guess I need step-by-step assistance on what to do from that pre-merge screenshot. While I did have a pretty lengthy thread on all of the problems I had with an ASA conversion last year, that thread isn't helping me here. Nothing is working as expected.

Actually, perhaps starting at the beginning would help - do I only choose Panorama or do I also select the target firewall cluster? That point wasn't covered in the ASA video series as it was firewall to firewall with no Panorama.

Was I correct in converting all objects to Shared?

Re: SRX to Panorama export mappings question

azuniga — Mon, 29 Nov 2021 16:33:21 GMT

Hello @justamoment

I am not sure how a object can be shared in the SRX platform but you would need to first migrate over the objects into the Panorama device and merge it then convert it to shared since that is what we use on our end. I think you may have first made it shared within the SRX environment then tried to merge it which will not work.

Re: SRX to Panorama export mappings question

justamoment — Mon, 29 Nov 2021 16:43:03 GMT

Ok. I have lots of snapshots pre-merge so let me check for that.

Do I have the mappings correct in the screenshot except for the Objects? If the Objects are wrong (shouldn't go to shared), where do I put them? The new cluster's DG?

Also, while the SRX doesn't do Global rules (zone-less), it does have what are called Global objects but I don't know if that's the same thing as PAN's Shared objects (all of our SRX objects are Global).

Re: SRX to Panorama export mappings question

azuniga — Mon, 29 Nov 2021 18:08:24 GMT

Hello @justamoment

That is fine you should be able to just dump them into the shared section with no problems unless you were planning on not having them become a shared object.

Re: SRX to Panorama export mappings question

justamoment — Mon, 29 Nov 2021 18:10:14 GMT

Oh, I definitely want them to be Shared objects - all of our objects are Shared. Do I drop them as in the Shared in the DG section as indicated in the screenshot?

Re: SRX to Panorama export mappings question

azuniga — Mon, 29 Nov 2021 18:53:54 GMT

Hello @justamoment

It would be shared within the DG and not within the template section.

Re: SRX to Panorama export mappings question

justamoment — Tue, 30 Nov 2021 18:53:49 GMT

At some point, my objects became a mix of vsys & shared. Below is the Export page and a snippet of address objects showing vsys vs. shared:

So, how do I map those? Like this:

Or do I need to go back to an old snapshot (from 2 days ago 😕 ) from before shared appeared?

Re: SRX to Panorama export mappings question

azuniga — Tue, 30 Nov 2021 19:30:38 GMT

You could always just migrate them over into the Panorama side then select them and convert to shared as an option, they show vsys now but if you right click and hit convert to shared it should move it to shared after exporting them to the panorama configuration.

Re: SRX to Panorama export mappings question

justamoment — Tue, 30 Nov 2021 21:26:07 GMT

I think I've figured out when the Address Objects get jumbled from all vsys to 1568 shared. What's also strange is if I "filter" on vsys1 it shows all of them where shared only shows the ones showing shared.

What I found is that the Address Objects changed after I merged the duplicate Address Groups.

Should I just not clean anything up except invalids, merge configs, and then cleanup the duplicates? Or maybe, only cleanup the duplicates that don't cause the change to shared?

Re: SRX to Panorama export mappings question

azuniga — Tue, 30 Nov 2021 22:48:24 GMT

Hello @justamoment

If you have a duplicate in the shared and vsys1 and you merge them then the shared should always take priority within that merge, so if you are cleaning it up that way you will accomplish what you would like to accomplish if the environment exist like that right now.

Re: SRX to Panorama export mappings question

justamoment — Tue, 30 Nov 2021 23:20:05 GMT

That makes sense - I just wasn't expecting changing groups to affect address objects.

Re: SRX to Panorama export mappings question

justamoment — Tue, 30 Nov 2021 23:31:26 GMT

So do I have the mappings correct with a mix of shared & vsys objects in my last screenshot?

Re: SRX to Panorama export mappings question

azuniga — Tue, 30 Nov 2021 23:49:02 GMT

Yes that looks accurate to me if I understand what you are doing.

Re: SRX to Panorama export mappings question

justamoment — Wed, 01 Dec 2021 00:03:13 GMT

I think the Network section is pretty self-explanatory.

1) Left | Shared | Objects to Right | DG | shared (created by cleaning up duplicates)

2) Left | Objects and Left | Policies to Right | DG | CORE-FW1

Alternately, as mentioned above, I could just not cleanup the object duplicates to avoid the conversion to shared and clean them up post-export-merge.

Re: SRX to Panorama export mappings question

Manikanags — Wed, 01 Dec 2021 10:00:50 GMT

Would you mind posting all the steps from the scratch once you complete the migration?

Re: SRX to Panorama export mappings question

justamoment — Wed, 01 Dec 2021 15:14:19 GMT

I'll post what I can remember but I've been more or less following the ASA conversion video on Youtube that Lynn did. The twists are that I'm using Panorama and not firewall to firewall and I get results I don't like and have to rollback to an earlier snapshot or start over completely.

Re: SRX to Panorama export mappings question

justamoment — Wed, 01 Dec 2021 21:50:02 GMT

Okay, I cleaned up all of the post-merge duplicates, generated API calls, and tried to send the API calls for shared addresses and it almost immediately failed for:

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ address -> <hostname> \\'<hostname>\\' is already in use]]><\/line><\/msg>","date":"2021-12-01 12:43:13"}}

Other failures:

tcp-9001 -> tag \'merged\' is already in use

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ service -> tcp-9001 -> tag \\'merged\\' is already in use]]><\/line><line><![CDATA[ service -> tcp-9001 -> tag is invalid]]><\/line><\/msg>","date":"2021-12-01 13:06:49"}}

I saw this the last time I got this point as well but I had started over thinking I had made a mistake.

I was able to send ethernet & AE interfaces successfully.

Re: SRX to Panorama export mappings question

justamoment — Wed, 01 Dec 2021 22:00:28 GMT

Other failures:

Services Groups

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ service-group -> RDP -> members \\'tcp-3389-3389-\\' is not a valid reference]]><\/line><line><![CDATA[ service-group -> RDP -> members is invalid]]><\/line><\/msg>","date":"2021-12-01 13:59:06"}}

zones

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ zone -> T1-T2-Uplink-SRX -> network -> layer3 \\'ae8.16\\' is not a valid reference]]><\/line><line><![CDATA[ zone -> T1-T2-Uplink-SRX -> network -> layer3 is invalid]]><\/line><\/msg>","date":"2021-12-01 13:55:54"}}

I have zero confidence in Security Policies so I'm not going to bother.

Re: SRX to Panorama export mappings question

justamoment — Wed, 01 Dec 2021 22:29:38 GMT

Interesting - I did a sub-atomic Generate API Requests and then sent that services port (tcp-9001) and it worked.