About sjanita

  design wise yes you can migrate in phases and there are different design options you can consider. Within Expedition you will need to migrate all but only enable the objects and policies you need for the segment(s) you want to cutover.    If you choose to migrate only certain network segments its recommend that those segments have their own ingress/egress interfaces unless you split vlan's across different trunks. Then you will need to deploy the palo alto in parallel with your current firewall.   Its possible to migrate in phases but the planning and design requires a longer conversation you should have with your partner or palo alto professional services team. ... View more

you'll have to decide on your desried design goal - are you planning to use VSYS or are you ok with using multiple virtual routers to isolate traffic? if you will be using panorama you'll have to decide if the vsys will be in the same or different device groups (DG).   Is your plan to split some policies and objects between the 2 vsys? If you will be using Panorama are your plans to have both vsys in the same or different device groups? if the VSYS will be members of different DG you can import all policies and objects into shared at first then add VSYS specific policies and objects afterwards. ... View more

have you moved the objects from the cisco config (from vsys1 on the left hand side) to the vsys1 on the right hand side?   Adding those objects should enable the 'Merge' button ... View more

the permissions and owners must also be applied at the directory level. Your screenshots show the permissions and owner at the file level.   $sudo ls -ld ./home/logs   The /home/logs directory must provide privileges for www-data and +x permissions ... View more

if you expand the folders that you merged into (in the abse config) do you seen objects in a 'pending' state? IF yes that will trigger the option to merge.   if you do not see objects in the folder(s) in a oending state then the merge button will not be available. ... View more

based on the sympton you describe - not able to save the settings can you reapply the update and test agasin.   $sudo apt-get update $sudo apt-get install expedition-beta ... View more

to verify and debug the json format of the file you can open it using firefox. If there is a json formatting error with the file firefox usually will provide the line and character location(s) of the characters causing the json format to be considered invalid. ... View more

can you share the ASA config by emailing to fwmigrate at paloaltonetworks.com? There were changes in the migration behavior in the Expedition ASA parser which breaks out certain policies (that uses address groups) that results in the additional policy count. I can verify that is the result you are seeing in your migration. ... View more

update ver 1.1.23 to be published today will provide a fix for this issue ... View more

for the UI refresh issues can you check the remaining space in your root partition:   From the CLI of your Expedition server issue the below command.   $df -a   Check the available space of the vg-root directory. This seems to be causing the issue if the disk is 80% or higher capacity.   expedition@Expedition : ~ $ df -a Filesystem                       1K-blocks     Used Available Use% Mounted on sysfs                                   0       0         0     - /sys proc                                     0       0         0     - /proc udev                               3002164       0   3002164   0% /dev devpts                                   0       0         0     - /dev/pts tmpfs                               604736     8400     596336   2% /run /dev/mapper/Expedition--vg-root   18502968 6977800   10562200   40% / securityfs                               0       0         0     - /sys/kernel/security tmpfs                             3023672       0   3023672   0% /dev/shm tmpfs                                 5120       0       5120   0% /run/lock tmpfs                             3023672       0   3023672   0% /sys/fs/cgroup cgroup                                   0       0         0     - /sys/fs/cgroup/systemd pstore                                   0       0         0     - /sys/fs/pstore cgroup                                   0       0         0     - /sys/fs/cgroup/blkio cgroup                                   0       0         0     - /sys/fs/cgroup/cpu,cpuacct cgroup                                   0       0         0     - /sys/fs/cgroup/devices cgroup                                   0       0         0     - /sys/fs/cgroup/freezer cgroup                                   0       0         0     - /sys/fs/cgroup/memory cgroup                                   0       0         0     - /sys/fs/cgroup/net_cls,net_prio cgroup                                   0       0         0     - /sys/fs/cgroup/perf_event cgroup                                   0       0         0     - /sys/fs/cgroup/cpuset cgroup                                   0       0         0     - /sys/fs/cgroup/pids cgroup                                   0       0         0     - /sys/fs/cgroup/hugetlb mqueue                                   0       0         0     - /dev/mqueue hugetlbfs                               0       0         0     - /dev/hugepages systemd-1                               0       0         0     - /proc/sys/fs/binfmt_misc debugfs                                 0       0         0     - /sys/kernel/debug fusectl                                 0       0         0     - /sys/fs/fuse/connections /dev/sda1                           482922   111167     346821   25% /boot lxcfs                                   0       0         0     - /var/lib/lxcfs tmpfs                               604736       0     604736   0% /run/user/1000 ... View more