topic Re: Missing Security Zone in Export XML Expedition Cisco ASA to PA Template in Expedition Discussions

Missing Security Zone in Export XML Expedition Cisco ASA to PA Template

M.Danuarta — Mon, 14 Oct 2024 03:26:36 GMT

Hello everyone,

I imported the configuration from Cisco ASA to PA-460 by following the tutorial from https://www.youtube.com/watch?v=-gbQ-YcgoPs&list=PLD6FJ8WNiIqVez8EBeoyRsnQcKTA5FuZ-. Everything went well except for the Security Zone section which was not exported in the XML file. Can somebody help me?

Re: Missing Security Zone in Export XML Expedition Cisco ASA to PA Template

dpuigdomenec — Mon, 14 Oct 2024 11:09:00 GMT

Hi @M.Danuarta

Could you check you moved also the zones while doing the drag and drop on the export section. Please see above image as an example.

Also reach out to fwmigrate@paloaltonetworks.com to get in touch with the team and if needed jump into a call.

Thanks!

Re: Missing Security Zone in Export XML Expedition Cisco ASA to PA Template

M.Danuarta — Mon, 14 Oct 2024 11:49:44 GMT

Hello @dpuigdomenec ,

Thanks for the response, yes I have done that but it's okay because I have found a solution by using an older version of Expedition which is 1.2.93.

Maybe bug in 1.2.96?

Re: Missing Security Zone in Export XML Expedition Cisco ASA to PA Template

dpuigdomenec — Mon, 14 Oct 2024 15:16:39 GMT

Hi @M.Danuarta It could be a bug in 1.2.96. I will test in my lab and publish here my results. Thanks!

Re: Missing Security Zone in Export XML Expedition Cisco ASA to PA Template

lychiang — Mon, 14 Oct 2024 20:00:31 GMT

Hi @M.Danuarta I have verified with merging a ciscoasa config and panorama config in Expedition v1.2.96 and export it out as xml file, I was able to see all the zones are showing in the xml file. I suspect could be when you drag and drop the zone folder from left to right , you drop it to the DG folder instead of template->Device->vsys1 like the solution mentioned in below article:

https://live.paloaltonetworks.com/t5/expedition-discussions/drag-and-drop-source-configuration-to-base-configuration-issue/td-p/528510

if you need further helps, please contact fwmigrate@paloaltonetworks.com. Thank you!

Re: Missing Security Zone in Export XML Expedition Cisco ASA to PA Template

M.Danuarta — Tue, 15 Oct 2024 02:22:12 GMT

Hello @lychiang , thanks for trying to help
But in the project I'm working on it's a direct migration to the firewall not through panorama. I have followed the tutorial from this video https://www.youtube.com/watch?v=RMHfO4MA0jw&ab_channel=PaloAltoNetworksLIVEcommunity and the result is still the zone is not exported to xml.

But i want to try through panorama too to see if it works

Re: Missing Security Zone in Export XML Expedition Cisco ASA to PA Template

M.Danuarta — Tue, 15 Oct 2024 03:00:46 GMT

Ah yes, it turns out that if it is through the panorama configuration file, the zone is exported properly. But I still can't migrate directly to the firewall config.

Re: Missing Security Zone in Export XML Expedition Cisco ASA to PA Template

dpuigdomenec — Tue, 15 Oct 2024 13:08:58 GMT

Hi @M.Danuarta

I can confirm it is a bug on version 1.2.96 and it is fixed in 1.2.97 (ETA 21/OCT).

The issue is happening when migrating to a FW. The default template for the zone is not properly set and that causes Zones are not exported in the XML/API and set commands file.

Thanks for pointing this out,

Best