How to handle auto zone?

[rhap4boy]

Trying to migrate from Cisco ASA to Palo Alto using Expedition.

These 6 addresses are being flagged as Invalid Addresses.

object network obj_any-01
subnet 0.0.0.0 0.0.0.0
object network obj_any-02
subnet 0.0.0.0 0.0.0.0

object network obj_any-03
subnet 0.0.0.0 0.0.0.0

object network obj_any-04
subnet 0.0.0.0 0.0.0.0

object network obj_any-05
subnet 0.0.0.0 0.0.0.0

object network obj_any-06
subnet 0.0.0.0 0.0.0.0

ject network obj_any-01
nat (inside,dmz) dynamic interface
object network obj_any-02
nat (inside,outside) dynamic obj-0.0.0.0
object network obj_any-03
nat (inside,dmz) dynamic obj-0.0.0.0

object network obj_any-04
nat (dmz,outside) dynamic obj-0.0.0.0
object network obj_any-05
nat (management,outside) dynamic obj-0.0.0.0
object network obj_any-06
nat (management,dmz) dynamic obj-0.0.0.0

What is the correct and efficient way to handle this in expedition without manual entires?

[sjanita]

in PanOS - the address 0.0.0.0/0.0.0.0 is an invalid address. You can use the 'search and replace' option to replace those objects with the PanOS predefined address object of 'any' which is equivalent to 0.0.0.0/0

[rhap4boy]

Thank you for the quick response. 

I don't see the predefined address object of 'any'.  Do I simply type it in?

[sjanita · Accepted solution]

yes you are right, my mistake the 'any' object is only visible with the policy as a predefined option.

There are 2 options to take action:

Create an object: name: any-0.0.0.0 value: 0.0.0.0/0

MEerge the objects using the "same value" of 0.0.0.0/0.0.0.0 and correct the merged object to have a value of 0.0.0.0/0.

Since there are multiple references you can manully find the policies where those objects are referenced and change to the 'any' option in each policy.

[ssparling]

Did this end up being resolved by doing this?  Can you share how and what you did?