Migration Cisco to PAN

mamuhopo — Tue, 05 Apr 2022 03:07:23 GMT

Hello,

I have run a config through the migration tool and I have noticed the following application generate warnings-

icmp- I understand I change this to- ping

ipsec-esp- I have no idea what this should be changed to?

gre(generic routing encapsulation)- No idea what this should be changed to?

Any help would be appreciated.

Re: Migration Cisco to PAN

TomYoung — Wed, 06 Apr 2022 23:34:23 GMT

Hi @mamuhopo ,

These IP protocols need to be changed to applications. You are correct that ICMP should be changed to ping. Be aware that non-ping ICMP is now blocked but previously allowed on the ASA. The protocols ipsec-esp and gre have applications of the same names in PA. https://applipedia.paloaltonetworks.com/

Typically, these changes need to be made in the security policy in Expedition. I clone the L4 rule and create a new L7 rule with the new applications. Check out the "Replace Services by App-ID" section here -> https://live.paloaltonetworks.com/t5/expedition-articles/expedition-user-guide-v1-2/ta-p/285157#toc-hId-1689743346.

Thanks,

Tom

topic Re: Migration Cisco to PAN in General Topics

Migration Cisco to PAN

Re: Migration Cisco to PAN