Missing Security Zone in Export XML Expedition Cisco ASA to PA Template

[M.Danuarta]

Hello everyone,

I imported the configuration from Cisco ASA to PA-460 by following the tutorial from https://www.youtube.com/watch?v=-gbQ-YcgoPs&list=PLD6FJ8WNiIqVez8EBeoyRsnQcKTA5FuZ-. Everything went well except for the Security Zone section which was not exported in the XML file. Can somebody help me?

[dpuigdomenec]

Hi @M.Danuarta 

Could you check you moved also the zones while doing the drag and drop on the export section. Please see above image as an example.

Also reach out to fwmigrate@paloaltonetworks.com to get in touch with the team and if needed jump into a call.

Thanks!

[M.Danuarta]

Hello @dpuigdomenec ,

Thanks for the response, yes I have done that but it's okay because I have found a solution by using an older version of Expedition which is 1.2.93.

Maybe bug in 1.2.96?

[dpuigdomenec]

Hi @M.Danuarta It could be a bug in 1.2.96. I will test in my lab and publish here my results. Thanks!

[lychiang]

Hi @M.Danuarta I have verified with merging a ciscoasa config and panorama config in Expedition v1.2.96 and export it out as xml file, I was able to see all the zones are showing in the xml file. I suspect could be when you drag and drop the zone folder from left to right , you drop it to the DG folder instead of template->Device->vsys1  like the solution mentioned in below article:

https://live.paloaltonetworks.com/t5/expedition-discussions/drag-and-drop-source-configuration-to-ba...

if you need further helps, please contact fwmigrate@paloaltonetworks.com. Thank you!

[M.Danuarta]

Hello @lychiang , thanks for trying to help
But in the project I'm working on it's a direct migration to the firewall not through panorama. I have followed the tutorial from this video https://www.youtube.com/watch?v=RMHfO4MA0jw&ab_channel=PaloAltoNetworksLIVEcommunity and the result is still the zone is not exported to xml.

But i want to try through panorama too to see if it works

[M.Danuarta]

Ah yes, it turns out that if it is through the panorama configuration file, the zone is exported properly. But I still can't migrate directly to the firewall config.

[dpuigdomenec · Accepted solution]

Hi @M.Danuarta 

I can confirm it is a bug on version 1.2.96 and it is fixed in 1.2.97 (ETA 21/OCT).

The issue is happening when migrating to a FW. The default template for the zone is not properly set and that causes Zones are not exported in the XML/API and set commands file.

Thanks for pointing this out,

Best