SRX to Panorama export mappings question

[justamoment]

Hi

I have converted all objects to Shared and this picture illustrates what I think is the correct mappings of each element.  Please confirm/correct as necessary.  Thanks!

[Manikanags]

Would you mind posting all the steps from the scratch once you complete the migration?

[justamoment]

I'll post what I can remember but I've been more or less following the ASA conversion video on Youtube that Lynn did.  The twists are that I'm using Panorama and not firewall to firewall and I get results I don't like and have to rollback to an earlier snapshot or start over completely.

[justamoment]

Okay, I cleaned up all of the post-merge duplicates, generated API calls, and tried to send the API calls for shared addresses and it almost immediately failed for:

<hostname> \'<hostname\' is already in use]]>

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ address -> <hostname> \\'<hostname>\\' is already in use]]><\/line><\/msg>","date":"2021-12-01 12:43:13"}}

Other failures:

tcp-9001 -> tag \'merged\' is already in use

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ service -> tcp-9001 -> tag \\'merged\\' is already in use]]><\/line><line><![CDATA[ service -> tcp-9001 -> tag is invalid]]><\/line><\/msg>","date":"2021-12-01 13:06:49"}}

I saw this the last time I got this point as well but I had started over thinking I had made a mistake.

I was able to send ethernet & AE interfaces successfully.

[justamoment]

Other failures:

Services Groups

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ service-group -> RDP -> members \\'tcp-3389-3389-\\' is not a valid reference]]><\/line><line><![CDATA[ service-group -> RDP -> members is invalid]]><\/line><\/msg>","date":"2021-12-01 13:59:06"}}

zones

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ zone -> T1-T2-Uplink-SRX -> network -> layer3 \\'ae8.16\\' is not a valid reference]]><\/line><line><![CDATA[ zone -> T1-T2-Uplink-SRX -> network -> layer3 is invalid]]><\/line><\/msg>","date":"2021-12-01 13:55:54"}}

I have zero confidence in Security Policies so I'm not going to bother.

[justamoment]

Interesting  - I did a sub-atomic Generate API Requests and then sent that services port (tcp-9001) and it worked.