Expedition bugs?

[sidetrack]

I stumbled across two potential bugs in Expedition 1.0.107 the other day, using it to merge duplicates and unused objects from a Panorama (8.1.5) config.

1. Editing a config that originally contained over 10,000 objects (across different DGs) resulted in some shared objects being defined twice - this was after merging duplicate and removing unused objects, the config imported to Panorama would not commit and resulted in an error "objecet already exists". We found the object was defined twice in the shared candidate config:

  <shared>
    <address>
        <entry name="test.com">
            <fqdn>test.com</fqdn>
        </entry>
        <entry name="test.com">
            <fqdn>test.com</fqdn>
        </entry>
    </address>
  </shared>

And also defined twice within the shared config in the output from Expedition:

<entry name="test.com"><fqdn>test.com</fqdn></entry><snip/><entry name="test.com"><fqdn>test.com</fqdn></entry>

We couldn't manually remove the duplicates from the XML as there were at least two more if not hundereds of these duplicated entries. After some manipulation of the source XML I got the object count down to about 4,000 before merging duplicates in Expedition, after which the exported config was fine until we hit the next bug.

2. Authentication rules failed to commit due to an invalid log-authentication-timeout. Appears Expedition introduced this log-authentication-timeout setting with no values as it did not exist in the imported config and was not accepted by Panorama 8.1.5:

 <pre-rulebase>
  <authentication>
    <rules><entry name="example"><snip/><log-authentication-timeout/><timeout>60</timeout><snip/></entry></rules>
  </authentication>
 </pre-rulebase>

The workaround was to remove the log-authentication-timeout entries in the XML.

@aestevez I can share the raw and optimised configs if you need.

[sidetrack]

Version could have been 1.1.3 not 1.0.107

[dgildelaig]

Yes, please. Share those with us at fwmigrate at paloaltonetworks dot com.

We will take a look into it