I need to add a vsys to migrating configuration in expedition

[Kevin_Osemene]

Hello all,

I am migrating a Juniper SRX to an existing Palo Alto firewall that is managed by Panorama. I have an Expedition instance able to read the Panorama and attached devices via API. My thinking is to separate the two firewall configurations into two separate logical entities, vsys1 would be for the existing Palo Alto firewall configs, vsys2 would be for the SRX configurations. I have both the Palo Alto and SRX configurations loaded into expedition but I try to add a new vsys under the device > virtual systems and then hit the + button but I don't get any option to add the vsys. Just a dropdown from the bottom bar which mentions something about templates. 

 

I'm sure this is expected but I need some help getting past this. What steps am I missing?

[lychiang]

Hi @Kevin_Osemene @I would suggest add device group , vsys and template in the panorama before you export it out and import it into the expedition. 

[Kevin_Osemene]

Ok yeah that is what I was missing to keep these devices logically separated. But import/export is done with the API and I show the following:

I have to pull in the entire panorama config to merge configuration. If I make the new DG/Template/vsys, I will still run into the same problem as before, no?

[dpuigdomenec]

Hi @Kevin_Osemene 

Once you move your migrated configuration to your created DG/Template/Vsys, you can import them to your device using load partial configuration command: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-cli-quick-start/use-the-cli/load-configurations...

Hope this helps,

Best regards,

David