topic Re: clean up unused objects within Panorama using expedition? in Panorama Discussions

clean up unused objects within Panorama using expedition?

S_Hiebert — Thu, 03 Feb 2022 16:20:44 GMT

hello all,

PA newb here. I recently transitioned to a firewall admin job and am learning my way around Palo Alto for the first time. one issue I've been tasked with exploring is an issue where one of our firewalls has fallen out of sync because it is a VM and has limited object storage capabilities. it is the only VM in our production network. We've explored the idea of just unchecking the "share unused objects" box in panorama, but apparently some of my predecessors weren't so careful when crafting new local rules on other firewalls throughout our AS and referenced panorama pushed objects in their local rules.

needless to say this going to be a quagmire of a project to clean up the firewalls, and after that's done, I'm sure there will be a lot of unused objects leftover in panorama after the cleanup is finished.

while doing some digging I discovered PA has a tool called Expedition which can supposedly identify and remove unused objects in PA firewalls. can expedition be used with panorama in this same capacity? that would make my life a million times easier because otherwise I see no way to identify whether or not an object or applicable object group is used.

any insights would be much appreciated.

Re: clean up unused objects within Panorama using expedition?

TomYoung — Wed, 23 Mar 2022 18:54:26 GMT

Hi @S_Hiebert ,

Expedition can work with Panorama. https://www.youtube.com/watch?v=r_l_NjGHv90

Another way to find out is to delete the object. If it is used, you will get an error.

Thanks,

Tom

Re: clean up unused objects within Panorama using expedition?

MarkDufault — Thu, 13 Apr 2023 13:51:22 GMT

I'm curious if you are using expedition on current hardware. What I mean is, I installed the latest expedition only to find that I could not import configs from my current hardware, nor did it support current software versions. I have used it in the past but gave up because of this. Is anyone else having this issue and if so have you found ways around it? I can't be too specific because when I gave up I just had the server team delete the box. But my delema is I would love to be able to cleanup my firewalls. I especially like the ability to let me know unused objects for this purpose.