topic Re: Viewing the migrated configuration in Panorama in Expedition Discussions

Viewing the migrated configuration in Panorama

MGRashmi — Thu, 13 Dec 2018 14:00:06 GMT

Hi,

I used "Expedition" tool to migrate configuration from a cisco FWSM context to Panorama. I follwed the steps mentioned in the "Expedition-UserGuide-v1.0". I followed the steps to export the configuration from Expedition to Panorama. The action shows "succeeded", but i am not able to view the exported configuration in Panorama. I also tried importing the xml file into Panorama, but i do not know the next steps to view the configuration in Panorama. Please help the path in which the imported configuration in panorama will be available and the command to access it/load it to Panorama.

Also, i have few queries related to contexts merging. In our source cisco firewall, there are 10 contexts. We are planning to merge few contexts and have lesser number of contexts in the palo alto. Is it possible to export only the objects, services and policies into palo alto using expedition and create routes, interfaces manually? Is there any best practices guide in relation to merging contexts before export?

Thanks,

Rashmi M

Re: Viewing the migrated configuration in Panorama

sjanita — Thu, 13 Dec 2018 16:40:22 GMT

prior to generating the XML in Expedition did you issue the 'Merge' option to save your migrated config into the appropriate Panorama device-group and template configs?

Re: Viewing the migrated configuration in Panorama

MGRashmi — Fri, 14 Dec 2018 06:32:38 GMT

Hi,

Yes, i merged the configuration prior to generating the xml.

Re: Viewing the migrated configuration in Panorama

sjanita — Fri, 14 Dec 2018 21:36:33 GMT

I have seen a smiliar issue wher ethe problem seemed to be with the base config file.

One option you may want to try is to export a new copy of the Panorama config, import that newly exported config into Expedition as your base and try the merge again.

Re: Viewing the migrated configuration in Panorama

MGRashmi — Mon, 17 Dec 2018 07:24:50 GMT

Hi sjanita,

Thanks for your response. I will try importing a new base config into expedition as you have suggested and post the results. Thanks a lot.

Re: Viewing the migrated configuration in Panorama

MGRashmi — Mon, 24 Dec 2018 12:49:55 GMT

Hi,

After merging Cisco configuration with Panorama base configuration, i imported it to Panorama. The Panorama and Palo alto firewalls are new and do not have any policies/objects.

I am attaching a screenshot of the export page taken from migration tool. I am trying to copy the policies and objects from "vsys-1" of Cisco to "vsys-s-dmz" of Panorama. I do not have a drop down for objects and policies under "vsys-s-dmz" in my base configuration. I am not seeing any errors in the API calls.

I also attempted a manual export. I am new to Panorama and i am not able to find out how to get into the "vsys-s-dmz" to see if the policies are getting imported properly. The Panorama policy file shows only default vsys (Vsys-1) and shared policies. Please suggest if i am doing anything wrong in follwoing the procedure for migration.

Re: Viewing the migrated configuration in Panorama

MGRashmi — Wed, 26 Dec 2018 05:53:10 GMT

I moved the "vsys-s-dmz" to a separate template and the export worked correctly after that. Thanks!!

Re: Viewing the migrated configuration in Panorama

sjanita — Wed, 26 Dec 2018 16:10:58 GMT

after clicking on 'merge' you can view the merged configurations under the 'API Output Manager' tab.

Run the 'SubAtomic' option to display and view the individual objects.

Re: Viewing the migrated configuration in Panorama

nextgensecurity — Thu, 11 Jul 2019 19:31:17 GMT

Also, I did not see any mention in this thread of the Load Config Partial command, required for getting the config components from Expedition into Panorama device group and template...