- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
06-16-2021 02:00 PM
Hi,
Currently I'm migration 3 cisco ASA to one 3220 cluster.
From cisco configuration not exist VCP, simple config with gigaethernets with tagging.
But the customer wants implement aggregate interfaces in palo alto firewall.
My question is, It is possible create the ae grupo and ae interfaces in expedition to migrate push this new configuration to PA?
Thanks
06-17-2021 07:32 AM - edited 06-17-2021 08:00 AM
Hi Azuniga,
How?, because I see the option. But expedition not give me the option to set up the ip address, zone and virtual router to ae subinterface.
I'm running expedition v1.1.100. Or that option is possible when I performed the merge. Because right now I'm working on cisco config. Until now I do not upload the PANOS base config to expedition because the firewalls is flying to datacenters.
In my case the customer wants use ethenert1/7 and ethernet1/8 as part of aggregate group. I do not see how to do in expedition.
06-17-2021 08:42 AM
Hello @mss.support
You must be creating it as a layer 2 AE interface. Attached is a screenshot of a layer 3 AE interface.
06-17-2021 09:13 AM
Hi Azuniga,
Thanks for your answer.
This were my steps.
1. Create the ae1 aggregate group.
2. Create the ethernet1/7 and ethernet1/8.
3. Change configuration from ethernet to aggregate-ethernet and assigned to ae1 group.
4. Create layer3 interface and assigned to VR, ip and tag set up as subinterface in ae1.
This is the correct steps?
And last question, this config is in one of the cisco config, as I mentioned until now I do not have uploaded the PANOS running config base into expedition.
So when I merge the cisco configs of the 3 ASA to single PANOS the ae1 groups do not generate issues ? Because this group will be the same in the 3 cisco ASA configs?.
Thanks
06-17-2021 09:26 AM
Hello @mss.support
To upload the PAN configuration go ahead and hit import just as you did the Cisco configuration but when you go to the export tab go ahead and hit "set base config" which in this case should use the pan configuration you uploaded and both configurations within the export tab should show up side by side. As for the aggregate interface creation yes you are correct although the tag part is optional.
06-17-2021 09:34 AM
Thanks Azuniga for all help!!.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!