Expedition bugs?

Reply
L2 Linker

Expedition bugs?

I stumbled across two potential bugs in Expedition 1.0.107 the other day, using it to merge duplicates and unused objects from a Panorama (8.1.5) config.

 

1. Editing a config that originally contained over 10,000 objects (across different DGs) resulted in some shared objects being defined twice - this was after merging duplicate and removing unused objects, the config imported to Panorama would not commit and resulted in an error "objecet already exists". We found the object was defined twice in the shared candidate config:

  <shared>
    <address>
        <entry name="test.com">
            <fqdn>test.com</fqdn>
        </entry>
        <entry name="test.com">
            <fqdn>test.com</fqdn>
        </entry>
    </address>
  </shared>

And also defined twice within the shared config in the output from Expedition:

<entry name="test.com"><fqdn>test.com</fqdn></entry><snip/><entry name="test.com"><fqdn>test.com</fqdn></entry>

We couldn't manually remove the duplicates from the XML as there were at least two more if not hundereds of these duplicated entries. After some manipulation of the source XML I got the object count down to about 4,000 before merging duplicates in Expedition, after which the exported config was fine until we hit the next bug.

 

2. Authentication rules failed to commit due to an invalid log-authentication-timeout. Appears Expedition introduced this log-authentication-timeout setting with no values as it did not exist in the imported config and was not accepted by Panorama 8.1.5:

 

 <pre-rulebase>
  <authentication>
    <rules><entry name="example"><snip/><log-authentication-timeout/><timeout>60</timeout><snip/></entry></rules>
  </authentication>
 </pre-rulebase>

The workaround was to remove the log-authentication-timeout entries in the XML.

 

@aestevez I can share the raw and optimised configs if you need.

Highlighted
L2 Linker

Re: Expedition bugs?

Version could have been 1.1.3 not 1.0.107

L4 Transporter

Re: Expedition bugs?

Yes, please. Share those with us at fwmigrate at paloaltonetworks dot com.

We will take a look into it

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!