Interface re-mapping to ae subinterfaces

[BatD]

Hi Expedition team

Recently I had a project, which required changing a number of physical firewall interfaces to a single aggregated tagged sub-interfaces ( e.g. ethernet1/1,1/2, 1/3, etc. changed to ae1.1, 1.2, 1.3).

I decided to use Expedition “interface re-mapping” option. To start with I don’t seem to be able to directly rename Ethernet interface to ae sub interface. I found a workaround by first remapping Ethernet interface to ae (e.g. ethernet 1/11 to ae1), then I get duplicate ae1 interface and I edit the new ae1 interface, changing it from ae1 to ae1.11.

This worked, although it takes longer, because it needs two actions for each interface: remap erhernet1/11 to ae1, then rename ae1 to ae1.11.

The other problem was that not all references to the Ethernet interfaces were changes. For example in Interfaces references were not changed in the following places:

• In NAT policies interface was changed in the translated source, however not changed in “Original Packet -> Destination Interface.
• Interfaces in PBF policies were not changed
• Interfaces not changed in Global Protect Portals and Gateways.
• Local Interface in VPN Gateways were not changed
• QoS Interfaces were not changed, however this is understandable.

I had to manually edit the XML file, which eventually worked, however it was a lot of additional work and prone to mistakes.

I really like the tool and find it an enormous help.

I am not sure if this is the right place to report bugs. I just wanted to check if this is the expected behaviour or if it is a bug that can be fixed. 

[bagherib]

Great job reporting the details of this issue.  I am looking forward to the answer/resolution.

[alestevez · Accepted solution]

Hi,

What you described is the behavior we develop so it works as designed, doesnt mean that's the best, so we will think a better way that allow you to select the interfaces and apply the logic you want, let us think about it.

The tool was designed to Migrate configs from 3rd parties and there is why at the time to remap interfaces we were thinking only the objects we support from other vendors what are just the interfaces and Zones, QoS, etc its from PANOS devices and we didnt think about those, but thanks to you we will increase the support at the time to remap interface to replace everywhere with the new references.

Thanks you in the name of my team for the deailed explanation and for allow us to improve 🙂

[BatD]

@alestevez

Thank you for that. With the new 3200 and 5200 seriesand some of the old platform approaching end of life we see a few platform migration projects, so there will probably be more demand for Palo to Palo migrations. The feature will really help as when moving platform customer often change the physical interfaces and consolidate the old (often incorrectly configured) Ethernet links into a single fibre aggregated interfaces.