Expedition migrates ASA vxlan protocol to wrong port

[crabevil]

Hi,

we had an issue with a connection after migrating from ASA to PaloAlto Firewall because Expedition was migrating the vxlan protocol to the wrong port udp/6500, but it should be udp/4789.

Can you fix this bug?

Regards

[lychiang]

Hi @crabevil  Can you please open a TAC case and attach the original ciscoasa config in the case, please write an email to fwmigrate@paloaltonetworks.com with the TAC  case# 

[crabevil]

Hi @lychiang,

how to open a TAC Case for Expedition?

In the costumer support portal there is no possability to open a TAC case for product type Expedition.

NOTE: Expedition is supported by the community as best effort. The Palo Alto Networks TAC does not provide support, so please post your questions in the Expedition discussionsarea.

[lychiang]

Hi @crabevil  You will select pan-os , and select serial# of the device, then you can open the case, the case is opened so you can secure share files with expedition team. 

[dpuigdomenec]

Hi @crabevil,

Thanks for reaching out.

As I included in the answer by email.

Expedition has a mapping file for each vendor to map known vendor services with defined port/protocol service or Palo Alto Networks app_id.

You can edit your file but take in mind it will be overridden once you update Expedition.

The file is located in /var/www/html/contents/parsers on the VM and named like 'vendor' - services.csv or 'vendor' - groups.csv (for group service objects).

I will include the vxlan service in the default mapping file for cisco in release 1.2.64.

Let me know if you have any further questions,

Best regards,

[MichaelBredell]

Interesting - I just had the same issue. migrated the obj "domain" to udp 6500. This wasn't from an ASA but from an old FWSM.

[dpuigdomenec]

Hi @MichaelBredell,

Thanks for reaching out.

You could use the same solution above adding the domain service.
Also if you share with us the mapping you used we could add it as default value. 

Best regards,

David