Unable to export Panorama configuration

[CKobelsky]

I recently converted a ruleset from ASA to Palo Alto.  I managed to get it imported into the appropriate device group in Panorama and eventually it all worked fine.  HOWEVER, I forgot to change the addresses and address groups to be shared objects before I did all that so now I need to convert them.

So, I pulled the Panorama configuration into Expedition so that I can convert the objects.  When I try to export the configuration the GUI just shows “Loading Server Profiles :: vsys:shared” and that is it.  When I look at /tmp/error I see the following:

Notice: Undefined offset: 0 in /var/www/html/libs/common/xml/panosxml.php on line 1366

Fatal error: Uncaught Error: Call to a member function addChild() on null in /var/www/html/libs/common/xml/panosxml.php:1366
Stack trace:
#0 /var/www/html/bin/configurations/output/output_function.php(377): xml_server_profiles(Object(SimpleXMLElement), Array)
#1 /var/www/html/bin/configurations/output/output_function.php(27): generate_xml(Array, '2')
#2 {main}
thrown in /var/www/html/libs/common/xml/panosxml.php on line 1366
ne 1366

I've tried a few different things (even not making any changes to the Panorama config and try to do the export I get the same issue), so I'm not sure what to do here.  It appears Expedition doesn't like something in my Panorama config, but don't know what it could be or how to fix it.  Any ideas?

[CKobelsky]

I should note I'm running Expedition 1.2.35 (used 1.2.31 initially I think to do the ruleset conversion)

[CKobelsky]

Just realized that in Panorama I can move objects into Shared by selecting them, clicking move, and then picking shared.  I only have 200 objects, so while it isn't as easy as Expedition it won't take long to do.

So, while I still have the problem in Expedition where it doesn't like my Panorama config at least I can fix the shared object issue a different way.  Any insights on how to troubleshoot the issue that Expedition has with my Panorama config would be appreciated

[lychiang]

Hi @CKobelsky Please remove all the server_profiles that you manually created in Expedition , if you need to reference server profile in the rules , you will need to created them in the panorama before you imported it as baseconfig in Expedition. 

[CKobelsky]

@lychiang I'm pretty new to all things Palo Alto, so I'll need to ask a couple follow-up questions 🙂

1. In Expedition I only imported the configuration from Panorama (which has a few server_profiles), I didn't manually create any server_profiles in Expedition.  Is that what you mean?

2. Did I go about this wrong?  All I did was import the configuration from Panorama, did my adjustments, and tried to write it back.  Is that not correct?  Do I have to import an empty baseconfig as well?  I didn't do the baseconfig part since I wasn't migrating/converting anything from a different device.

[lychiang]

What version of PAN-OS that your panorama using ? Are you exporting the whole running config ? Also What version of the expedition you are running ?  If the server profiles are in Panorama before you import it in, expedition should not have problem export it out.  

[CKobelsky]

It is Panorama 10.2.2-h1.  I exported the entire running-config along with all my templates and device groups (I don't have a lot right now) out of Panorama and imported that entire file into the Expedition project (368KB or so).  I also used a direct API connection as well which gives the same issues.

Even if I don't make any changes to the configuration in Expedition it hangs when I try to generate the XML

[lychiang]

what version of expedition you are running ? Please make sure you upgrade to the latest version.  If it still not working, please open a TAC case and attach the panorama config , please write email to fwmigrate@paloaltonetworks.com let us know what's the case#.  

[CKobelsky]

Running the latest version of Expedition (1.2.35)

[CKobelsky · Accepted solution]

Apparently the issue is due to my template names being longer than 32 characters.  Decreasing the length of my template names should fix the issue for now.  An updated version of Expedition that works with longer template names will fix the issue as well (which should come out sometime over the next few weeks).