Expedition support for PanOS9.1.1

[FilipElsen]

Dears,

We've needed to upgrade our Panorama & firewalls for bug fixing reasons to PanOs9.1.1.

Since the Panorama upgrade our migrations using Expedition are having issues:

PanOS9.1.1 with Expedition:

• Expedition pre 1.1.56: after a merge and config import, following is the config load error on Panorama: 

              "job failed because of configd restart"

• Expedition 1.1.60: config import works, but source and/or destinations objects are missing. This occurs repetively. (80% on security and NAT rules).

Is this known?

Which version of Expedition is supported for PanOs9.1.1?

Best regards,

Filip Elsen

[lychiang]

Hi Filip,

The latest version 1.1.61.2, it should work with PanOS9.1.1, please try update the expedition. 

[FilipElsen]

Hi Lychiang,

We'll give it a go and will let you know the result.

At the time of the last migration, the latest Expedition version was 1.1.60, which has issues with PanOs9.1.1.

Best regards,

Filip Elsen

[adevegamir]

Hi Filip,

Is possible to send us the config to tested this, please? Send to email fwmigrate@paloaltonetworks.com to study this case.

Thank you,

Regards,

[DamienDove]

Hi Filip, did you resolve this issue?

I'm loading a migrated config into 9.1.1 and the source and destination objects are missing.

[FilipElsen]

Hi @lychiang,

During previous COVID months, migrations were put on halt, but are restarting as of last week.

The firewalls and Panorama are on 9.1.1

We're on Expedition: 1.1.69.2 and still have issues.

The config had been prepared as before, but when importing it into Panorama we always hit: 

"job failed because of configd restart"

Best regards,

Filip

[FilipElsen]

Hi @DamienDove 

No - the issue is not solved.

When loading the migrated config, it works, but when performing a commit we get an error:

"job failed because of configd restart"

Best regards,

Filip

[FilipElsen]

Hi,

@sjanita @aestevez  @dgildelaig 

During the last COVID months, our migrations were put on hold and restarted last week.

The Firewalls & Panorama are on 9.1.1

In Expedition version:

• 1.1.60, Loading the merged configuration in Panorama worked. Committing the configuration in Panorama worked. Only this version had an issue since it was removing the source-ips, destination-ips and ports while merging the config. Similar like @DamienDove.
• 1.1.69.2 In this version, the config merge etc is working. Loading the merged config into Panorama following error is received:

Can you please have a look, we're blocked for the moment.

Thanks a lot,

Filip Elsen

[dgildelaig]

Just to discard options, there was nobody performing a management service restart during your commit process, right?

[FilipElsen]

Hi Didac,

Right!

We don't do this command often, which is good

Best regards,

Filip