Expedition support for PanOS9.1.1

[FilipElsen]

Dears,

We've needed to upgrade our Panorama & firewalls for bug fixing reasons to PanOs9.1.1.

Since the Panorama upgrade our migrations using Expedition are having issues:

PanOS9.1.1 with Expedition:

• Expedition pre 1.1.56: after a merge and config import, following is the config load error on Panorama: 

              "job failed because of configd restart"

• Expedition 1.1.60: config import works, but source and/or destinations objects are missing. This occurs repetively. (80% on security and NAT rules).

Is this known?

Which version of Expedition is supported for PanOs9.1.1?

Best regards,

Filip Elsen

[lychiang]

Hello @FilipElsen 

In your expedition, when you do a merge config , what version of the base config you use , can you confirm you are using the 9.1.2 base config on the right side. 

[FilipElsen]

Hi @lychiang,

Yes - indeed. The base config is the one from 9.1.2.

When importing the merged config: OK.

When loading the imported config, we select:

- Load shared objects

-Select device group & templates: only the specific DG (MGT) has been selected.

The policy is loaded, but sources & destinations (objects) + services are missing.

Best regards,

Filip

[lychiang]

Hi @FilipElsen After you exported the xml file from Expedition, can you open the xml file and verify the source, destination, services are indeed shown in the security policy . 

Another solution could help is to perform an API call to push the shared/DG address objects and service objects from Expedition to Panorama. Please see attached screenshot. You will go to "Export" -> "API output manager" -> Click on the blue button "Generate API Requests" , it will then list all the API calls, you can pick and choose which part of the config you want to push back to Panorama , by select the checkbox on that particular API call and click the green button "Send API Requests" , the column of the ID shows the order you need to follow, for example you will start with "TAG" -> "Shared Address object" -> "DG address object" Shared Service object" ->"DG service object" -> "shared security policy"->"DG security policy" .