Expedition - Panorama managed device

[Hugo_Nacif]

I finally got Expedition working and retrieved Panorama configuration successfully. When creating a project, should I add the firewall or Panorama ? Also, after cleaning up the config to the point it is ready to be deployed how can I push the config to the managed device through Panorama ?

I know Panorama have a configuration for device group and template so I am not sure how to see that on Expedition.

Thanks in advance,

Hugo

[azuniga]

Hello @Hugo_Nacif 

It depends where your configuration is stored, are you managing the firewall from the panorama or firewall directly? Depending on the answer depends on what should be imported into expedition.

[Hugo_Nacif]

I am managing the firewall from Panorama.

[azuniga]

Hello @Hugo_Nacif 

Import the panorama configuration and you can import it via API or XML. Here is a video series if it helps you in your endeavors. Also as a part of that playlist it shows how to address other issues within the configuration you may have.

https://www.youtube.com/watch?v=RMHfO4MA0jw&list=PLD6FJ8WNiIqVez8EBeoyRsnQcKTA5FuZ-&index=8

[Hugo_Nacif]

Hi @azuniga , thanks for the link. It helped me understand a bit more. If I merge and set as output using Panorama would overwrite the existing firewall rules on the device group I set ? I have some rules for Panorama on these devices already and that is not listed on Juniper's ruleset. I wonder if that would be a potential problem as it can interrupt Panorama from sending new configs to them.

[azuniga]

Hello @Hugo_Nacif 

I would always import the latest panorama configuration and merge it from there, if you export it as an XML and import into panorama then yes it will overwrite your configuration. You can import the XML and perform a partial load configuration only importing the changes you want, or you can perform an API push which will only import the changes made within expedition. So you have multiple options on how you would like to import that configuration.