SRX to Panorama export mappings question

Showing results for 
Show  only  | Search instead for 
Did you mean: 

SRX to Panorama export mappings question

L4 Transporter



I have converted all objects to Shared and this picture illustrates what I think is the correct mappings of each element.  Please confirm/correct as necessary.  Thanks!




Would you mind posting all the steps from the scratch once you complete the migration?

L4 Transporter

I'll post what I can remember but I've been more or less following the ASA conversion video on Youtube that Lynn did.  The twists are that I'm using Panorama and not firewall to firewall and I get results I don't like and have to rollback to an earlier snapshot or start over completely.

L4 Transporter

Okay, I cleaned up all of the post-merge duplicates, generated API calls, and tried to send the API calls for shared addresses and it almost immediately failed for:


<hostname> \'<hostname\' is already in use]]>

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ address -> <hostname> \\'<hostname>\\' is already in use]]><\/line><\/msg>","date":"2021-12-01 12:43:13"}}


Other failures:


tcp-9001 -> tag \'merged\' is already in use

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ service -> tcp-9001 -> tag \\'merged\\' is already in use]]><\/line><line><![CDATA[ service -> tcp-9001 -> tag is invalid]]><\/line><\/msg>","date":"2021-12-01 13:06:49"}}

I saw this the last time I got this point as well but I had started over thinking I had made a mistake.


I was able to send ethernet & AE interfaces successfully.

L4 Transporter

Other failures:


Services Groups

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ service-group -> RDP -> members \\'tcp-3389-3389-\\' is not a valid reference]]><\/line><line><![CDATA[ service-group -> RDP -> members is invalid]]><\/line><\/msg>","date":"2021-12-01 13:59:06"}}



{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ zone -> T1-T2-Uplink-SRX -> network -> layer3 \\'ae8.16\\' is not a valid reference]]><\/line><line><![CDATA[ zone -> T1-T2-Uplink-SRX -> network -> layer3 is invalid]]><\/line><\/msg>","date":"2021-12-01 13:55:54"}}


I have zero confidence in Security Policies so I'm not going to bother.

L4 Transporter

Interesting  - I did a sub-atomic Generate API Requests and then sent that services port (tcp-9001) and it worked.

L4 Transporter

Oh, I forgot mention previously but I found when I was fixing object duplicates that all of them had these descriptions that weren't what exists on the SRX.  They all had nearly the same thing and it was always cutoff at the max field size of 255 characters.

L4 Transporter

So, it looks like this description issue happens when a full vsys de-dupe is done.  When I select a single set of address objects (all the same name & value - e.g., a set of 10 duplicates) and run the de-dupe the description doesn't change.


I confirmed that in both cases the descriptions were correct for all objects in a set prior to running the de-dupe in both attempts.

  • 21 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!