I am using Expedition 1.1.80 to make bulk changes to Security Profile Groups that are used on rules. Once the changes are made I am using the API Output Manager to push the changes back to Panorama. Once this is done and I am sure the old security profile groups are no longer used I delete them. This works just fine most of the time but there are times where when I choose to delete the groups Pano comes back and tells me the groups are still used in rules. When I check the rules they are indeed using the NEW groups, not the old groups. The way to fix this is to just open the rules and save them again and the problem goes away. The problem with this approach is sometimes we are talking about 50 rules this needs to be done on and that defeats the whole point of automation using Expedition.   Any thoughts on what might be causing this and how to fix it? ... View more

I am migrating a Cisco ASA config that has an ACL that is applied to global (access-group CSM_FW_ACL_ in interface if_global) as opposed to an interface. I believe I understand how this is applied in the ASA but noticed that Expedition did nothing with the ACL as far as I can tell. Is there a way to handle this in Expedition to make it work? If not does anyone no another way to convert this ACL outside of Expedition? It is an extremely large ACL, otherwise I would just do it by hand.   Thanks. ... View more

Recently I have started running out of space in Expedition. I am in the process of requesting more space for the VM but this issue is something that has just started. I have 1 large project that is eating up 12GB of space by itself. There are a ton of rule merges that are happening and I can only do 10 at a time, so every time that happens a new 'undo' file is created around 10MB in size and none of them are getting cleaned up. At the moment there are over 2000 files in this projects backup directory (some of them are file size of 0). What's funny is that I had 2 projects of this size previously and had no drive space issues so something has changed in more recent versions of Expedition. What I also noticed is that the since last time I cleaned up files to create space there has only been about 340MB of new 'undo' files but the available drive space has shrunk by 1GB.   In any case, I need to find a workaround until I can secure more drive space. Should Expedition be cleaning up old 'undo' files? Has something changed or is there an issue in recent Expedition versions? If I need to manually delete 'undo' files is it safe to start deleting the older files? On the same note, in theory could you delete all of the 'undo' files except the most recent and be ok?    My version of Expedition is 1.1.32.   Thanks. ... View more

I am migrating a configuration over from a Cisco ASA that uses multiple contexts and have several questions about how to replicate that in a PA.   1. The ASA's use port-channel groups and for the internal and external those are shared. On the inside interface each belongs to the same group but uses a different VLAN tag. On the external interface, each interface uses the same group and same VLAN tag but the IP's for the interfaces are different. There is a system context that has interface information also. The question I have is can the PA be set up the same way? I am seeing contradicting information about this subject.   2. Each context has it's own routing table even though they share the internet connection (as stated above each external interface is on the same interface/VLAN tag but has a distinct IP address. Can this be done on the PA the same way? I know you can have multiple virtual routers or a shared router but would like to keep them separate.   Thanks. ... View more

When I am importing the XML from Expedition it has started to give me errors due to a tag that is present on merged objects. The tag is 'merged' and you can see it in Panorama in the tag column but when you open the object nothing is in that field. Determined that all I have to do is open the open and save it but this is a real pain with the number of merged objects.   I have another message open under Expedition with the same issue for interfaces that gives me an error that all I have to do is open the interface and save it to clear the error. These issues seem to be related. ... View more

I am trying to do a ‘load config partial mode append’ to get the policy exported from Expedition into a device-group that already has policy/nat rules (those rules are from a previous Expedition project, and we are trying to combine 2 ASA contexts into 1 PA firewall). Normally I do a ‘merge’ instead of an ‘append,’ but the rules/nat’s are merging in a way I don’t want. When I try to append the rules, I get an error that says:   Device-group -> ‘name of device group here’ -> pre-rulebase -> rulebase unexpected here. Discarding.   Needless to say neither the rules or nats are getting imported. Any thoughts? ... View more

I am trying to combine 2 ASA contexts into a single PA config. Used Expedition to do the migration separately for each context and everything but the rules worked as expected. Normally I use 'load config partial mode merge' which also worked in this case for everything but rules. Not sure what the trigger is to merge rules but it did indeed merge a bunch which is probably ok except for the NAT's. With those the merging created all kinds of issues. With that in mind I tried to do an 'append' instead of merge but it failed with a duplication issue (device-group -> 'dg name here' -> pre-rulebase -> rulebase unexpected here. Discarding).   None of the rules or nats were added. It is almost like it didn't expect there to be an existing rulebase there, but that would seem to be weird if you are using 'append'.   Any thoughts on what might be happening here.  ... View more