Migration of Cisco PIX configuration - Help needed

[Benjiman]

Hi Expedition Forum,

When migrating from a Cisco PIX I am receiving the following error when I attempt API call to push to Panorama.

This is the PIX line.

access-list FROM-Zone extended permit icmp object-group Subnets any unreachable

/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='DG-Host-device']/application

<application><entry name="icmp_destination_unreachable"><category>networking</category><subcategory>ip-protocol</subcategory><risk>1</risk><technology>network-protocol</technology><evasive-behavior>no</evasive-behavior><consume-big-bandwidth>no</consume-big-bandwidth><used-by-malware>no</used-by-malware><able-to-transfer-file>no</able-to-transfer-file><has-known-vulnerability>no</has-known-vulnerability><tunnel-other-application>no</tunnel-other-application><tunnel-applications>no</tunnel-applications><prone-to-misuse>no</prone-to-misuse><pervasive-use>no</pervasive-use><file-type-ident>no</file-type-ident><virus-ident>no</virus-ident><data-ident>no</data-ident><default><ident-by-icmp-type><type>3</type><code>0</code></ident-by-icmp-type></default></entry></application>

Answer from device:
{"1":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ application -> icmp_destination_unreachable \\'icmp_destination_unreachable\\' is already in use]]><\/line><\/msg>","date":"2020-03-04 16:54:58"}}

Any help is greatly appreciated.

Regards,

Ben

[lychiang]

Hi Benjiman,

I tried your API in my environment , using Expedition version 1.1.59 and Panorama 8.1 and the API call is successfully and I was able to see the custom-AppID , 'Iicmp_destination_unreachable" show up in the panorama.  What version is your expedition and Panorama in your environment?

Thank you!
Lynn

[Benjiman]

Hi Lynn

Thank you for your quick response. 

Panorama is running at 9.0.4

Expedition is 1.1.58.1 (fresh install yesterday to attempt to rectify the issue)

I'm also experiencing a lot of issues when merging, like it will change interface names to Ethernet2, rather than ethernet1/1... and remove associations from Zones etc...

[lychiang]

Hello Benjiman,

 I will recommend you to upgrade your expedition to latest version which is 1.1.59 to see if it works after upgrade.

[Benjiman]

I already tried an update yesterday, this new version must have come out within the last 18 hours. 

Is there a link between Expedition versions and Panorama versions?

[Benjiman · Accepted solution]

Hi Lynn,

It appears that the line "access-list FROM-Zone extended permit icmp object-group Subnets any unreachable" created a NEW application that was a duplicate of the inbuilt icmp_unreach

Thanks for your help 🙂