Expedition bugs?

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Expedition bugs?

L2 Linker

I stumbled across two potential bugs in Expedition 1.0.107 the other day, using it to merge duplicates and unused objects from a Panorama (8.1.5) config.


1. Editing a config that originally contained over 10,000 objects (across different DGs) resulted in some shared objects being defined twice - this was after merging duplicate and removing unused objects, the config imported to Panorama would not commit and resulted in an error "objecet already exists". We found the object was defined twice in the shared candidate config:

        <entry name="test.com">
        <entry name="test.com">

And also defined twice within the shared config in the output from Expedition:

<entry name="test.com"><fqdn>test.com</fqdn></entry><snip/><entry name="test.com"><fqdn>test.com</fqdn></entry>

We couldn't manually remove the duplicates from the XML as there were at least two more if not hundereds of these duplicated entries. After some manipulation of the source XML I got the object count down to about 4,000 before merging duplicates in Expedition, after which the exported config was fine until we hit the next bug.


2. Authentication rules failed to commit due to an invalid log-authentication-timeout. Appears Expedition introduced this log-authentication-timeout setting with no values as it did not exist in the imported config and was not accepted by Panorama 8.1.5:


    <rules><entry name="example"><snip/><log-authentication-timeout/><timeout>60</timeout><snip/></entry></rules>

The workaround was to remove the log-authentication-timeout entries in the XML.


@aestevez I can share the raw and optimised configs if you need.


L2 Linker

Version could have been 1.1.3 not 1.0.107

Yes, please. Share those with us at fwmigrate at paloaltonetworks dot com.

We will take a look into it

  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!