SRX to Panorama export mappings question

[justamoment]

Hi

I have converted all objects to Shared and this picture illustrates what I think is the correct mappings of each element.  Please confirm/correct as necessary.  Thanks!

[Manikanags]

Would you mind posting all the steps from the scratch once you complete the migration?

[justamoment]

I'll post what I can remember but I've been more or less following the ASA conversion video on Youtube that Lynn did.  The twists are that I'm using Panorama and not firewall to firewall and I get results I don't like and have to rollback to an earlier snapshot or start over completely.

[justamoment]

Okay, I cleaned up all of the post-merge duplicates, generated API calls, and tried to send the API calls for shared addresses and it almost immediately failed for:

<hostname> \'<hostname\' is already in use]]>

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ address -> <hostname> \\'<hostname>\\' is already in use]]><\/line><\/msg>","date":"2021-12-01 12:43:13"}}

Other failures:

tcp-9001 -> tag \'merged\' is already in use

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ service -> tcp-9001 -> tag \\'merged\\' is already in use]]><\/line><line><![CDATA[ service -> tcp-9001 -> tag is invalid]]><\/line><\/msg>","date":"2021-12-01 13:06:49"}}

I saw this the last time I got this point as well but I had started over thinking I had made a mistake.

I was able to send ethernet & AE interfaces successfully.

[justamoment]

Other failures:

Services Groups

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ service-group -> RDP -> members \\'tcp-3389-3389-\\' is not a valid reference]]><\/line><line><![CDATA[ service-group -> RDP -> members is invalid]]><\/line><\/msg>","date":"2021-12-01 13:59:06"}}

zones

{"25":{"device":"Panorama","status":"fail","text":"<msg><line><![CDATA[ zone -> T1-T2-Uplink-SRX -> network -> layer3 \\'ae8.16\\' is not a valid reference]]><\/line><line><![CDATA[ zone -> T1-T2-Uplink-SRX -> network -> layer3 is invalid]]><\/line><\/msg>","date":"2021-12-01 13:55:54"}}

I have zero confidence in Security Policies so I'm not going to bother.

[justamoment]

Interesting  - I did a sub-atomic Generate API Requests and then sent that services port (tcp-9001) and it worked.

[justamoment]

Oh, I forgot mention previously but I found when I was fixing object duplicates that all of them had these descriptions that weren't what exists on the SRX.  They all had nearly the same thing and it was always cutoff at the max field size of 255 characters.

[justamoment]

So, it looks like this description issue happens when a full vsys de-dupe is done.  When I select a single set of address objects (all the same name & value - e.g., a set of 10 duplicates) and run the de-dupe the description doesn't change.

I confirmed that in both cases the descriptions were correct for all objects in a set prior to running the de-dupe in both attempts.