topic Re: Expedition issue: Security policies not merging automatically(While trying to migrate from ASA to PA in Expedition Discussions

Expedition issue: Security policies not merging automatically(While trying to migrate from ASA to PA

Santosh.Ponnapalli — Wed, 18 Mar 2020 09:48:36 GMT

Hello,

We are trying to migrate the CISCO ASA configuration to the Palo Alto using expedition and we have imported the ASA config to the expedition by clicking on "Group access-lists by remarks".

We have around 38K access lists on Cisco ASA and the security policies on the Palo alto firewall is not merging as expected. We did migrations before and the access-lists around 30K are shrinked to around 2800.

Currently expedition is running on 1.1.58.1. We are not able to identify the root cause and expecting assistance on this.

Thank you in advance.

Thanks,

Santosh

Re: Expedition issue: Security policies not merging automatically(While trying to migrate from ASA t

dgildelaig — Wed, 18 Mar 2020 10:44:08 GMT

Do you get the expected results if you do not mark the option of Grouping ACL's?

Re: Expedition issue: Security policies not merging automatically(While trying to migrate from ASA t

Santosh.Ponnapalli — Wed, 18 Mar 2020 10:46:25 GMT

Thank you for the response Dgildelaig

Regardless of marking and non-marking the Merge option, the acl count is the same.

Re: Expedition issue: Security policies not merging automatically(While trying to migrate from ASA t

dgildelaig — Wed, 18 Mar 2020 11:01:02 GMT

Can you contact us to fwmigrate@paloaltonetworks.com and we can check why may be some ACLs missing?
If you have already identified any missing ACL in the migration, provide also some information about it, in case we spot what specific that ACL may have that we did not support yet.

Re: Expedition issue: Security policies not merging automatically(While trying to migrate from ASA t

Santosh.Ponnapalli — Wed, 18 Mar 2020 11:05:25 GMT

Hello,

The ACL's are not missing, however the issue is with ACL merging. We have around 30000 security policies.

For suppose, if we have 10 rules with source, same destination port and with 10 destinations, Ideally the expedition should merge this to single rule, but this is not happening now.

Can you please help us on this matter.

Re: Expedition issue: Security policies not merging automatically(While trying to migrate from ASA t

dgildelaig — Wed, 18 Mar 2020 12:06:11 GMT

Absolutely,

Please contact with me at fwmigrate@paloaltonetworks.com to schedule a session

Re: Expedition issue: Security policies not merging automatically(While trying to migrate from ASA to PA

FranciscoAgu — Wed, 02 Aug 2023 19:30:32 GMT

I've imported the base config from the pano and imported the cisco asa config i want to merge into the base config. i copy over the network and vsys and interfaces and objects and policies, then get the export and when i load it into the palo fw the config doesn't show the cisco policies

Re: Expedition issue: Security policies not merging automatically(While trying to migrate from ASA to PA

lychiang — Wed, 02 Aug 2023 19:41:41 GMT

@FranciscoAgu
Before you export the panorama config , please create a new device group and template for this specific asa migration, so when you merge it , you can drag and drop the objects to the device group and template accordingly

Re: Expedition issue: Security policies not merging automatically(While trying to migrate from ASA to PA

FranciscoAgu — Wed, 02 Aug 2023 20:36:20 GMT

I tried what you suggested and that worked. Thank you, that did the trick. I appreciate the assistance.