topic Re: I need to add a vsys to migrating configuration in expedition in Expedition Discussions

I need to add a vsys to migrating configuration in expedition

Kevin_Osemene — Wed, 23 Aug 2023 19:43:41 GMT

Hello all,

I am migrating a Juniper SRX to an existing Palo Alto firewall that is managed by Panorama. I have an Expedition instance able to read the Panorama and attached devices via API. My thinking is to separate the two firewall configurations into two separate logical entities, vsys1 would be for the existing Palo Alto firewall configs, vsys2 would be for the SRX configurations. I have both the Palo Alto and SRX configurations loaded into expedition but I try to add a new vsys under the device > virtual systems and then hit the + button but I don't get any option to add the vsys. Just a dropdown from the bottom bar which mentions something about templates.

I'm sure this is expected but I need some help getting past this. What steps am I missing?

Re: I need to add a vsys to migrating configuration in expedition

lychiang — Wed, 23 Aug 2023 19:46:41 GMT

Hi @Kevin_Osemene @I would suggest add device group , vsys and template in the panorama before you export it out and import it into the expedition.

Re: I need to add a vsys to migrating configuration in expedition

Kevin_Osemene — Wed, 23 Aug 2023 20:01:02 GMT

Ok yeah that is what I was missing to keep these devices logically separated. But import/export is done with the API and I show the following:

I have to pull in the entire panorama config to merge configuration. If I make the new DG/Template/vsys, I will still run into the same problem as before, no?

Re: I need to add a vsys to migrating configuration in expedition

dpuigdomenec — Mon, 04 Sep 2023 09:48:15 GMT

Hi @Kevin_Osemene

Once you move your migrated configuration to your created DG/Template/Vsys, you can import them to your device using load partial configuration command: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-cli-quick-start/use-the-cli/load-configurations/load-a-partial-configuration

Hope this helps,

Best regards,

David