topic Re: What are "Ghost" address objects in Expedition Discussions

What are "Ghost" address objects

ArthurEmr — Mon, 10 Sep 2018 21:17:42 GMT

What is Expeditions definition of "Ghost" objects?

Re: What are "Ghost" address objects

bagherib — Mon, 10 Sep 2018 22:22:35 GMT

I would guess something like an Address Group that is missing its host objects.

Re: What are "Ghost" address objects

alestevez — Tue, 11 Sep 2018 08:58:12 GMT

We use that term when you import a configuration from a firewall who has some objects added by a panorama. When we read the config from the firewall could refer to an object and that object is not defined on that configuration because was injected by panorama, in Expedition those objects seen in the config but not defined are called "Ghosts"

Re: What are "Ghost" address objects

santonic — Wed, 17 Apr 2019 07:35:03 GMT

I've seen ghost addresses from config imported from ASA. I guess in this case it's objects that weren't defined as objects on ASA and were just used as network addresses?

Re: What are "Ghost" address objects

dgildelaig — Wed, 17 Apr 2019 09:28:13 GMT

A ghost object is that object in Expedition that does not get converted into an object in the final PANOS configuration.

Based on this, we can find two type pf ghost objects:

- The configuration is from a FW that will use objects inherited from a Panorama. Even the config can use those objects, those are not defined in the FW, therefore we call them ghosts.

- The configuration is using some explicit IPs in security rules, Nats, etc, that will not consume an object in the final PANOS Configuration, but you can still see them in the "address" table in Expedition. Those objects will be explicitly defined in the security rule and do not refer to PANOS address objects. This applies as well to services.