topic Re: Merge Address Groups from Check Point to Palo Alto base config in Expedition Discussions

Merge Address Groups from Check Point to Palo Alto base config

AntonioTrigo — Mon, 24 Jan 2022 16:45:42 GMT

In Expedition 1.2.5 and lower, when moving objects from Check Point R80.x to Panorama Base Config, Address Groups are being merged only by name, not by name and value. Services, Service Groups and Addresses report duplicate objects to fix before exporting configuration, but not address groups.

We are using a base config that has already several objects in production.

Objects should be merged into shared context.

If we convert check point objects to shared, before the merge, the objects are reported as duplicates after the merge.

This has impacted our migration.

Could you please help out?

Re: Merge Address Groups from Check Point to Palo Alto base config

lychiang — Mon, 24 Jan 2022 16:51:17 GMT

@AntonioTrigo Address Group needs to contain same exact members than can be merged. So the process will be merge the duplicated address object first , then move on to the address group. Please do not convert any objects to share before you merge the config , you can drag all objects from checkpoint config on the left to "shared" on the right during the merge. After merged, review duplicated objects again.

Re: Merge Address Groups from Check Point to Palo Alto base config

AntonioTrigo — Mon, 24 Jan 2022 16:56:16 GMT

Hi, @lychiang. Like i posted, Address Groups are not showing any duplicate objects after the merge, because Expedition is merging all Address Groups with same name, even if the addresses inside the group are not the same.

So after the merge we have hundreds of services, service groups, tags, address duplicated, but no address groups.

Re: Merge Address Groups from Check Point to Palo Alto base config

lychiang — Mon, 24 Jan 2022 16:59:58 GMT

Have you convert any objects to shared before you merge with base config ? that's the root cause of the issues.

Re: Merge Address Groups from Check Point to Palo Alto base config

AntonioTrigo — Tue, 25 Jan 2022 11:27:58 GMT

No, we do not convert for this to happen.