topic Re: Correct invalid services in Expedition in Expedition Discussions

Correct invalid services in Expedition

AK74 — Mon, 04 Jul 2022 23:17:14 GMT

Hello there,

I am currently migrating my ASA 5585 to a Palo 5260 using Expedition tool. Everything on the dashboard has been rectified, except for few services that shows "invalid" and used .

I've noticed that Expedition has replaced "icmp" service in ASA to "discard"

Does anyone know why is that ?

Also, there're some invalid services such as (icmp-echo. icmp-echo-reply) but when I try to search/locate them, I don't see them under security policy but they're used in Object groups as shown below So, basically I need to convert them to Ping application as if they were used in security policy ?

Finally, I've got "esp" as invalid service but again it's located in an object group. So, how to correct it? replace it with an application (ipsec-esp) or service ?

Thanks

Re: Correct invalid services in Expedition

Ifixtheinternet — Wed, 26 Oct 2022 16:27:29 GMT

I have the same problem and question.

In addition to those, I also have a service object showing up for "GRE", but there is no object in my ASA configured for GRE, or port 47, either individually or within any port range. So I'm not sure where that came from.
They show unused, but I'd still like to understand why they were generated.
I'm wondering if there's any way to display in Expedition what object / config line in the ASA that Expedition referred to in order to create the objects.

Re: Correct invalid services in Expedition

lychiang — Wed, 26 Oct 2022 16:34:42 GMT

Hi @Ifixtheinternet Those are default service protocol from your cisco asa config, if it's red dot , means it's not being used in any group object or policies.

Re: Correct invalid services in Expedition

Ifixtheinternet — Wed, 26 Oct 2022 17:36:30 GMT

Thanks lychiang,

I was not familiar with default objects in the ASA until now.

One must perform a "show run all" on an ASA to see the default objects, which is where I found the default GRE object, as well as the default "echo" object.

The last piece I am uncertain about which AK74 also asked, is why the used service object for ICMP was renamed to "discard".
The service object configured in the ASA is just called "icmp". Not critical as we'll rename it anyway, but I'm still curious.

Re: Correct invalid services in Expedition

AK74 — Wed, 26 Oct 2022 22:45:40 GMT

What version of Expedition tool are you using ?