topic Re: I pulled in Panorama as a device, now what? in Expedition Discussions

I pulled in Panorama as a device, now what?

M.Anderson — Mon, 27 Feb 2023 20:44:13 GMT

We migrated an ASA to a PA and have it managed via Panorama. We made all the "objects" local to the firewall (vs. Shared). What I'm trying to do now is compare the Shared objects in Panorama to the objects on the PAN with the local objects so we don't end up w/dup Shared objects. When I create a new project I'm not seeing the firewall as an option to import, nor can I take the xml file from the firewall (I can but there's nothing there, it's a 5k file). Prior to Panorama management the file was 245k. What am I'm missing? Is my methodology sound? TIA

Re: I pulled in Panorama as a device, now what?

lychiang — Mon, 27 Feb 2023 21:11:15 GMT

Hi @M.Anderson Please follow below doc to perform migration from firewall to panorama, then you can use expedition to import panorama config to clean up the duplicate objects.

https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-to-panorama-management

Re: I pulled in Panorama as a device, now what?

M.Anderson — Mon, 27 Feb 2023 21:16:58 GMT

Thank you for the reply lychiang but the firewall has already been pulled into Panorama and Panorama has already been imported into Expedition. This is where I’m stuck.

Re: I pulled in Panorama as a device, now what?

lychiang — Mon, 27 Feb 2023 23:04:15 GMT

First of all, when you create an device in panorama , have you retrieved the running config from content tab, also , when you create a project, you will need to assign the panorama to the device , then when you go inside the project, go to import , you should see the panorama in the import tab , you can then double click to import the config. If all the objects are already in panorama config, then when you finished import the panorama config, it should take you to the dashboard , there it will shows you the duplicate objects.

Re: I pulled in Panorama as a device, now what?

M.Anderson — Tue, 28 Feb 2023 11:03:56 GMT

Thank you @lychiang

Responses in BOLD

First of all, when you create a device in panorama , have you retrieved the running config from content tab - Yes I had done this

when you create a project, you will need to assign the panorama to the device - This is what I was missing to get the devices in the Project. I went to Project > Settings > Devices and added the FW device. Again, what I'm trying to achieve is to compare ONLY the duplicate objects between a single FW and Panorama, not all duplicate objects. I did see it work for services [see attached] but, addresses shows all DG's.

Re: I pulled in Panorama as a device, now what?

lychiang — Tue, 28 Feb 2023 17:21:52 GMT

It works on Address objects , the same way , once you click on the number on the duplicate address object column on dashboard, it will take you to the address object view and those address object there are duplicate either in the same DG or among different DG , shared . There is a vsys column , it tells you where the objects located.

Re: I pulled in Panorama as a device, now what?

M.Anderson — Wed, 08 Mar 2023 16:15:33 GMT

I think I could achieve what I'm looking for if Expedition allowed you to filter on the vsys...