Correct invalid services in Expedition

[AK74]

Hello there,

I am currently migrating my ASA 5585 to a Palo 5260 using Expedition tool. Everything on the dashboard has been rectified, except for few services that shows "invalid" and used .

I've noticed that Expedition has replaced "icmp" service in ASA to "discard" 

Does anyone know why is that ?

Also, there're some invalid services such as (icmp-echo. icmp-echo-reply) but when I try to search/locate them, I don't see them under security policy but they're used in Object groups as shown below So, basically I need to convert them to Ping application as if they were used in security policy ?

Finally, I've got "esp" as invalid service but again it's located in an object group. So, how to correct it? replace it with an application (ipsec-esp) or service ?

Thanks

[Ifixtheinternet]

I have the same problem and question.

In addition to those, I also have a service object showing up for "GRE", but there is no object in my ASA configured for GRE, or port 47, either individually or within any port range. So I'm not sure where that came from.
They show unused, but I'd still like to understand why they were generated.
I'm wondering if there's any way to display in Expedition what object / config line in the ASA that Expedition referred to in order to create the objects.

[lychiang]

Hi @Ifixtheinternet Those are default service protocol from your cisco asa config, if it's red dot , means it's not being used in any group object or policies. 

[Ifixtheinternet]

Thanks lychiang,

I was not familiar with default objects in the ASA until now.

One must perform a "show run all" on an ASA to see the default objects, which is where I found the default GRE object, as well as the default "echo" object.

The last piece I am uncertain about which AK74 also asked, is why the used service object for ICMP was renamed to "discard".
The service object configured in the ASA is just called "icmp". Not critical as we'll rename it anyway, but I'm still curious.

[AK74]

What version of Expedition tool are you using ?