topic Re: Expedition migrates ASA vxlan protocol to wrong port in Expedition Discussions

Expedition migrates ASA vxlan protocol to wrong port

crabevil — Sat, 27 May 2023 05:47:17 GMT

Hi,

we had an issue with a connection after migrating from ASA to PaloAlto Firewall because Expedition was migrating the vxlan protocol to the wrong port udp/6500, but it should be udp/4789.

Can you fix this bug?

Regards

Re: Expedition migrates ASA vxlan protocol to wrong port

lychiang — Tue, 30 May 2023 20:12:30 GMT

Hi @crabevil Can you please open a TAC case and attach the original ciscoasa config in the case, please write an email to fwmigrate@paloaltonetworks.com with the TAC case#

Re: Expedition migrates ASA vxlan protocol to wrong port

crabevil — Sun, 04 Jun 2023 06:11:14 GMT

Hi @lychiang,

how to open a TAC Case for Expedition?

In the costumer support portal there is no possability to open a TAC case for product type Expedition.

NOTE: Expedition is supported by the community as best effort. The Palo Alto Networks TAC does not provide support, so please post your questions in the Expedition discussionsarea.

Re: Expedition migrates ASA vxlan protocol to wrong port

lychiang — Tue, 06 Jun 2023 16:43:18 GMT

Hi @crabevil You will select pan-os , and select serial# of the device, then you can open the case, the case is opened so you can secure share files with expedition team.

Re: Expedition migrates ASA vxlan protocol to wrong port

dpuigdomenec — Wed, 21 Jun 2023 10:06:33 GMT

Hi @crabevil,

Thanks for reaching out.

As I included in the answer by email.

Expedition has a mapping file for each vendor to map known vendor services with defined port/protocol service or Palo Alto Networks app_id.

You can edit your file but take in mind it will be overridden once you update Expedition.

The file is located in /var/www/html/contents/parsers on the VM and named like 'vendor' - services.csv or 'vendor' - groups.csv (for group service objects).

I will include the vxlan service in the default mapping file for cisco in release 1.2.64.

Let me know if you have any further questions,

Best regards,

Re: Expedition migrates ASA vxlan protocol to wrong port

MichaelBredell — Sat, 15 Jul 2023 11:58:00 GMT

Interesting - I just had the same issue. migrated the obj "domain" to udp 6500. This wasn't from an ASA but from an old FWSM.

Re: Expedition migrates ASA vxlan protocol to wrong port

dpuigdomenec — Mon, 17 Jul 2023 09:58:19 GMT

Hi @MichaelBredell,

Thanks for reaching out.

You could use the same solution above adding the domain service.
Also if you share with us the mapping you used we could add it as default value.

Best regards,

David