Expedition Migration-Invalid Address Group

[sebolj]

Hello,

I am currently migrating my ASA 5585 to a Palo 3260. Everything on the dashboard has been rectified, except for one address group that shows "invalid". I'm not sure how to correct this, it appears to hit two rules, but I'm not sure what the best way is to rectify this issue.

[azuniga]

Hello @sebolj

What version of expedition are you using? Also can you provide a screenshot of your issue?

[sebolj]

Hello,

I have applied snapshots with the version of Expedition and the invalid portion.

Thanks!

[azuniga]

Hello @sebolj 

Did you see any errors within the migration logs? (Screenshot attached)

[sebolj]

Here is my current snapshot. I was able to repair most of the items on the dashboard, except for that one address-group. 

This is all new to me, as I've never done a transition to Palo before, so apologies in advance!

[Jenifa]

Hi Sebolj, 

Have you found any resolution regarding this issue? Currently, even I am facing this issue

Regards,

Jenifa

[dpuigdomenec]

Hi @Jenifa 

Thanks for reaching out.

Please could you elaborate your issue?

Let me share our email if you prefer to share it using it: fwmigrate@paloaltonetworks.com

Thanks in advance,

David

[Jenifa]

Hi, Thanks for reaching out. Just like the issue mentioned by Sebolj, while migrating from Cisco ASA firewall to Paloalto firewall, there is a single invalid address group where all the address objects are grouped under a single group. What changes should be made in the invalid address group during migration? 

[dpuigdomenec]

Hi @Jenifa 

My first impression is that it looks like a bug as from your screenshots the address-group looks fine.

Question:

- Is there any warning in the Monitor or in the address-group warning tab pointing to that object?

- Could you share with us via a TAC case your configuration so we can debug the parser?

Thanks in advance,

David 

[Jenifa]

Hi Dpuigdomenec,

There are no warnings in the Monitor or in the address-group warning tab regarding the group. But there are 18479 address objects in that group. The maximum number of addresses allowed per group is just 500. So how do we resolve this?

[Jenifa]

We have initiated a TAC case for the previously mentioned issue related to an invalid address group containing over 18,000 address objects. We have shared the Cisco configuration file as part of this case. The assigned TAC case number is 02873599.

[dpuigdomenec]

Hi @Jenifa 

Thanks for sharing the configuration, let me review it and check what we can do.
Best regards,

David

[dpuigdomenec]

Hi @Jenifa 

With current Expedition version 1.2.85 you have 2 option:

1. Do a dynamic group.
2. Split into groups containing each 500 members.  

Both options are in the below menu on the address groups.
Next Expedition version 1.2.86 will include the feature to auto split into groups when doing the migration. A custom setting will allow to set the limit or turn off the feature (by default).