Expedition Migration-Invalid Address Group

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Expedition Migration-Invalid Address Group

L1 Bithead

Hello,

 

I am currently migrating my ASA 5585 to a Palo 3260. Everything on the dashboard has been rectified, except for one address group that shows "invalid". I'm not sure how to correct this, it appears to hit two rules, but I'm not sure what the best way is to rectify this issue.

12 REPLIES 12

L4 Transporter

Hello @sebolj

 

What version of expedition are you using? Also can you provide a screenshot of your issue?

Hello,

 

I have applied snapshots with the version of Expedition and the invalid portion.

 

Thanks!Migration3.PNGMigration2.PNGMigration1.PNG

Hello @sebolj 

 

Did you see any errors within the migration logs? (Screenshot attached)

 

Screen Shot 2020-09-22 at 1.47.08 PM.png

Here is my current snapshot. I was able to repair most of the items on the dashboard, except for that one address-group. 

 

This is all new to me, as I've never done a transition to Palo before, so apologies in advance!

 

 

MigrationLog5.PNGMigrationLog4.PNGMigrationlog3.PNGMigrationLog2.PNGMigrationLog1.PNG

Hi Sebolj

Have you found any resolution regarding this issue? Currently, even I am facing this issue

 

Regards,

Jenifa

Hi @Jenifa 

Thanks for reaching out.

Please could you elaborate your issue?

Let me share our email if you prefer to share it using it: fwmigrate@paloaltonetworks.com

Thanks in advance,

David

 

Hi, Thanks for reaching out. Just like the issue mentioned by Sebolj, while migrating from Cisco ASA firewall to Paloalto firewall, there is a single invalid address group where all the address objects are grouped under a single group. What changes should be made in the invalid address group during migration? 

L4 Transporter

Hi @Jenifa 

My first impression is that it looks like a bug as from your screenshots the address-group looks fine.

Question:

- Is there any warning in the Monitor or in the address-group warning tab pointing to that object?

- Could you share with us via a TAC case your configuration so we can debug the parser?

Thanks in advance,

David 

Hi Dpuigdomenec,

There are no warnings in the Monitor or in the address-group warning tab regarding the group. But there are 18479 address objects in that group. The maximum number of addresses allowed per group is just 500. So how do we resolve this?

We have initiated a TAC case for the previously mentioned issue related to an invalid address group containing over 18,000 address objects. We have shared the Cisco configuration file as part of this case. The assigned TAC case number is 02873599.

Hi @Jenifa 

Thanks for sharing the configuration, let me review it and check what we can do.
Best regards,

David

Hi @Jenifa 

 

With current Expedition version 1.2.85 you have 2 option:
  1. Do a dynamic group.
  2. Split into groups containing each 500 members.  
Both options are in the below menu on the address groups.
Next Expedition version 1.2.86 will include the feature to auto split into groups when doing the migration. A custom setting will allow to set the limit or turn off the feature (by default). 
  • 4025 Views
  • 12 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!