clean up unused objects within Panorama using expedition?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

clean up unused objects within Panorama using expedition?

L1 Bithead

hello all,

PA newb here. I recently transitioned to a firewall admin job and am learning my way around Palo Alto for the first time. one issue I've been tasked with exploring is an issue where one of our firewalls has fallen out of sync because it is a VM and has limited object storage capabilities. it is the only VM in our production network. We've explored the idea of just unchecking the "share unused objects" box in panorama, but apparently some of my predecessors weren't so careful when crafting new local rules on other firewalls throughout our AS and referenced panorama pushed objects in their local rules. 

needless to say this going to be a quagmire of a project to clean up the firewalls, and after that's done, I'm sure there will be a lot of unused objects leftover in panorama after the cleanup is finished.

while doing some digging I discovered PA has a tool called Expedition which can supposedly identify and remove unused objects in PA firewalls. can expedition be used with panorama in this same capacity? that would make my life a million times easier because otherwise I see no way to identify whether or not an object or applicable object group is used. 


any insights would be much appreciated. 

You cant believe everything you see on the internet- Benjamin Franklin

Cyber Elite
Cyber Elite

Hi @S_Hiebert ,


Expedition can work with Panorama.


Another way to find out is to delete the object.  If it is used, you will get an error.





Help the community: Like helpful comments and mark solutions.

L2 Linker

I'm curious if you are using expedition on current hardware. What I mean is, I installed the latest expedition only to find that I could not import configs from my current hardware, nor did it support current software versions. I have used it in the past but gave up because of this. Is anyone else having this issue and if so have you found ways around it? I can't be too specific because when I gave up I just had the server team delete the box. But my delema is I would love to be able to cleanup my firewalls. I especially like the ability to let me know unused objects for this purpose.


  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!