This feature is not complete, unfortunatelly.
What does feature this do?
Let me explain what it is meant to do when complete:
Notice that the controls to keep the projects in synch with the policies are very complex. We need to identify which objects are changing, which rules are being modified or moved, etc. and to know how would that effect to the current changes that you may have in the Expedition project.
Let's put one example:
Imagine you decided to delete an address object in the Expedition project, because you are doing some cleaning (you decided that using a range instead of multiple IP addresses as a source would increase the readability of the config).
However, somebody in the PA, decided to modify the address object and convert it into a subrange.
What should Expedition do in such case? Create the address object again? Verify that the new object is still redundant given the changes in your project? Raise a warning because you may overwrite some "interesting" changes in your PA?
In Which state is this feature now?
We have been covering quite a large subset of these changes, and only for Security Rules and Nat Rules (including address, services, apps, etc.) but there are several features that we have not covered, such as network settings.
For this reason, this feature has not been promoted and we may retake its implementation for PANOS 9.0, where we expect to be able to track the changes better.
What does it require to activate it?
Take a look into the rsyslog file in
You will see that this config in rsyslog has a logic to identify different types of Config and System syslog actions, and executes some database inserts to report seen config modifications. It requires of the module
to know how to read the syslog messages, which are defined in
However, we will have to extend thaose schemas to support PANOS 9.0 when we retake this task, as we were doing this implementation during PANOS 7.1.
I want to help
Suggestions or coding hands will be welcome to help into this feature completeness. ;)
You can contact us at fwmigrate at paloaltonetworks dot com or directly to me at dgildelaig at paloaltonetworks dot com
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!