Migration Cisco to PAN

[mamuhopo]

Hello,

I have run a config through the migration tool and I have noticed the following application generate warnings-

icmp-  I understand I change this to- ping

ipsec-esp-  I have no idea what this should be changed to?

gre(generic routing encapsulation)-  No idea what this should be changed to?

Any help would be appreciated.  

[TomYoung]

Hi @mamuhopo ,

These IP protocols need to be changed to applications.  You are correct that ICMP should be changed to ping.  Be aware that non-ping ICMP is now blocked but previously allowed on the ASA.  The protocols ipsec-esp and gre have applications of the same names in PA.  https://applipedia.paloaltonetworks.com/

Typically, these changes need to be made in the security policy in Expedition.  I clone the L4 rule and create a new L7 rule with the new applications.  Check out the "Replace Services by App-ID" section here -> https://live.paloaltonetworks.com/t5/expedition-articles/expedition-user-guide-v1-2/ta-p/285157#toc-....

Thanks,

Tom