Viewing the migrated configuration in Panorama

[MGRashmi]

Hi, 

I used "Expedition" tool to migrate configuration from a cisco FWSM context to Panorama. I follwed the steps mentioned in the "Expedition-UserGuide-v1.0".  I followed the steps to export the configuration from Expedition to Panorama. The action shows "succeeded", but i am not able to view the exported configuration in Panorama. I also tried importing the xml file into Panorama, but i do not know the next steps to view the configuration in Panorama. Please help the path in which the imported configuration in panorama will be available and the command to access it/load it to Panorama. 

Also, i have few queries related to contexts merging. In our source cisco firewall, there are 10 contexts. We are planning to merge few contexts and have lesser number of contexts in the palo alto. Is it possible to export only the objects, services and policies into palo alto using expedition and create routes, interfaces manually? Is there any best practices guide in relation to merging contexts before export?

Thanks, 

Rashmi M

[sjanita]

prior to generating the XML in Expedition did you issue the 'Merge' option to save your migrated config into the appropriate Panorama device-group and template configs?

[MGRashmi]

Hi, 

Yes, i merged the configuration prior to generating the xml. 

[sjanita]

I have seen a smiliar issue wher ethe problem seemed to be with the base config file. 

One option you may want to try is to export a new copy of the Panorama config, import that newly exported config into Expedition as your base and try the merge again.

[MGRashmi]

Hi sjanita,

Thanks for your response. I will try importing a new base config into expedition as you have suggested and post the results. Thanks a lot.

[MGRashmi]

Hi, 

After merging Cisco configuration with Panorama base configuration, i imported it to Panorama. The Panorama and Palo alto firewalls are new and do not have any policies/objects.

I am attaching a screenshot of the export page taken from migration tool. I am trying to copy the policies and objects from "vsys-1" of Cisco to "vsys-s-dmz" of Panorama. I do not have a drop down for objects and policies under "vsys-s-dmz" in my base configuration. I am not seeing any errors in the API calls.

I also attempted a manual export. I am new to Panorama and i am not able to find out how to get into the "vsys-s-dmz" to see if the policies are getting imported properly. The Panorama policy file shows only default vsys (Vsys-1) and shared policies. Please suggest if i am doing anything wrong in follwoing the procedure for migration. 

[MGRashmi · Accepted solution]

I moved the "vsys-s-dmz" to a separate template and the export worked correctly after that. Thanks!!

[sjanita]

after clicking on 'merge' you can view the merged configurations under the 'API Output Manager' tab. 

Run the 'SubAtomic' option to display and view the individual objects.

[nextgensecurity]

Also, I did not see any mention in this thread of the Load Config Partial command, required for getting the config components from Expedition into Panorama device group and template...