topic Re: Expedition Migration-Invalid Address Group in Expedition Discussions

Expedition Migration-Invalid Address Group

sebolj — Tue, 22 Sep 2020 19:36:50 GMT

Hello,

I am currently migrating my ASA 5585 to a Palo 3260. Everything on the dashboard has been rectified, except for one address group that shows "invalid". I'm not sure how to correct this, it appears to hit two rules, but I'm not sure what the best way is to rectify this issue.

Re: Expedition Migration-Invalid Address Group

azuniga — Tue, 22 Sep 2020 20:03:01 GMT

Hello @sebolj

What version of expedition are you using? Also can you provide a screenshot of your issue?

Re: Expedition Migration-Invalid Address Group

sebolj — Tue, 22 Sep 2020 20:08:23 GMT

Hello,

I have applied snapshots with the version of Expedition and the invalid portion.

Thanks!

Re: Expedition Migration-Invalid Address Group

azuniga — Tue, 22 Sep 2020 20:48:16 GMT

Hello @sebolj

Did you see any errors within the migration logs? (Screenshot attached)

Re: Expedition Migration-Invalid Address Group

sebolj — Wed, 23 Sep 2020 15:23:23 GMT

Here is my current snapshot. I was able to repair most of the items on the dashboard, except for that one address-group.

This is all new to me, as I've never done a transition to Palo before, so apologies in advance!

Re: Expedition Migration-Invalid Address Group

Jenifa — Wed, 10 Jan 2024 10:07:37 GMT

Hi Sebolj,

Have you found any resolution regarding this issue? Currently, even I am facing this issue

Regards,

Jenifa

Re: Expedition Migration-Invalid Address Group

dpuigdomenec — Wed, 10 Jan 2024 17:14:35 GMT

Hi @Jenifa

Thanks for reaching out.

Please could you elaborate your issue?

Let me share our email if you prefer to share it using it: fwmigrate@paloaltonetworks.com

Thanks in advance,

David

Re: Expedition Migration-Invalid Address Group

Jenifa — Thu, 25 Jan 2024 05:09:34 GMT

Hi, Thanks for reaching out. Just like the issue mentioned by Sebolj, while migrating from Cisco ASA firewall to Paloalto firewall, there is a single invalid address group where all the address objects are grouped under a single group. What changes should be made in the invalid address group during migration?

Re: Expedition Migration-Invalid Address Group

dpuigdomenec — Thu, 25 Jan 2024 08:36:26 GMT

Hi @Jenifa

My first impression is that it looks like a bug as from your screenshots the address-group looks fine.

Question:

- Is there any warning in the Monitor or in the address-group warning tab pointing to that object?

- Could you share with us via a TAC case your configuration so we can debug the parser?

Thanks in advance,

David

Re: Expedition Migration-Invalid Address Group

Jenifa — Thu, 25 Jan 2024 12:17:30 GMT

Hi Dpuigdomenec,

There are no warnings in the Monitor or in the address-group warning tab regarding the group. But there are 18479 address objects in that group. The maximum number of addresses allowed per group is just 500. So how do we resolve this?

Re: Expedition Migration-Invalid Address Group

Jenifa — Thu, 08 Feb 2024 09:02:05 GMT

We have initiated a TAC case for the previously mentioned issue related to an invalid address group containing over 18,000 address objects. We have shared the Cisco configuration file as part of this case. The assigned TAC case number is 02873599.

Re: Expedition Migration-Invalid Address Group

dpuigdomenec — Thu, 08 Feb 2024 09:37:30 GMT

Hi @Jenifa

Thanks for sharing the configuration, let me review it and check what we can do.
Best regards,

David

Re: Expedition Migration-Invalid Address Group

dpuigdomenec — Fri, 22 Mar 2024 10:05:57 GMT

Hi @Jenifa

With current Expedition version 1.2.85 you have 2 option:

Do a dynamic group.
Split into groups containing each 500 members.

Both options are in the below menu on the address groups.
Next Expedition version 1.2.86 will include the feature to auto split into groups when doing the migration. A custom setting will allow to set the limit or turn off the feature (by default).