About aporue

I am migrating a Cisco ASA config that has an ACL that is applied to global (access-group CSM_FW_ACL_ in interface if_global) as opposed to an interface. I believe I understand how this is applied in the ASA but noticed that Expedition did nothing with the ACL as far as I can tell. Is there a way to handle this in Expedition to make it work? If not does anyone no another way to convert this ACL outside of Expedition? It is an extremely large ACL, otherwise I would just do it by hand.   Thanks. ... View more

Recently I have started running out of space in Expedition. I am in the process of requesting more space for the VM but this issue is something that has just started. I have 1 large project that is eating up 12GB of space by itself. There are a ton of rule merges that are happening and I can only do 10 at a time, so every time that happens a new 'undo' file is created around 10MB in size and none of them are getting cleaned up. At the moment there are over 2000 files in this projects backup directory (some of them are file size of 0). What's funny is that I had 2 projects of this size previously and had no drive space issues so something has changed in more recent versions of Expedition. What I also noticed is that the since last time I cleaned up files to create space there has only been about 340MB of new 'undo' files but the available drive space has shrunk by 1GB.   In any case, I need to find a workaround until I can secure more drive space. Should Expedition be cleaning up old 'undo' files? Has something changed or is there an issue in recent Expedition versions? If I need to manually delete 'undo' files is it safe to start deleting the older files? On the same note, in theory could you delete all of the 'undo' files except the most recent and be ok?    My version of Expedition is 1.1.32.   Thanks. ... View more

I am migrating a configuration over from a Cisco ASA that uses multiple contexts and have several questions about how to replicate that in a PA.   1. The ASA's use port-channel groups and for the internal and external those are shared. On the inside interface each belongs to the same group but uses a different VLAN tag. On the external interface, each interface uses the same group and same VLAN tag but the IP's for the interfaces are different. There is a system context that has interface information also. The question I have is can the PA be set up the same way? I am seeing contradicting information about this subject.   2. Each context has it's own routing table even though they share the internet connection (as stated above each external interface is on the same interface/VLAN tag but has a distinct IP address. Can this be done on the PA the same way? I know you can have multiple virtual routers or a shared router but would like to keep them separate.   Thanks. ... View more

When I am importing the XML from Expedition it has started to give me errors due to a tag that is present on merged objects. The tag is 'merged' and you can see it in Panorama in the tag column but when you open the object nothing is in that field. Determined that all I have to do is open the open and save it but this is a real pain with the number of merged objects.   I have another message open under Expedition with the same issue for interfaces that gives me an error that all I have to do is open the interface and save it to clear the error. These issues seem to be related. ... View more

I am trying to do a ‘load config partial mode append’ to get the policy exported from Expedition into a device-group that already has policy/nat rules (those rules are from a previous Expedition project, and we are trying to combine 2 ASA contexts into 1 PA firewall). Normally I do a ‘merge’ instead of an ‘append,’ but the rules/nat’s are merging in a way I don’t want. When I try to append the rules, I get an error that says:   Device-group -> ‘name of device group here’ -> pre-rulebase -> rulebase unexpected here. Discarding.   Needless to say neither the rules or nats are getting imported. Any thoughts? ... View more

I am trying to combine 2 ASA contexts into a single PA config. Used Expedition to do the migration separately for each context and everything but the rules worked as expected. Normally I use 'load config partial mode merge' which also worked in this case for everything but rules. Not sure what the trigger is to merge rules but it did indeed merge a bunch which is probably ok except for the NAT's. With those the merging created all kinds of issues. With that in mind I tried to do an 'append' instead of merge but it failed with a duplication issue (device-group -> 'dg name here' -> pre-rulebase -> rulebase unexpected here. Discarding).   None of the rules or nats were added. It is almost like it didn't expect there to be an existing rulebase there, but that would seem to be weird if you are using 'append'.   Any thoughts on what might be happening here.  ... View more

I have a weird issue when I import the XLM into the firewalls and wanted to see if anyone has any thoughts on it. I am importing the interface configurations from Cisco ASA's into templates in Panorama that were migration in Expedition. The import into the template and the commit to Panorama works just fine but when I push to the firewall I keep running into the same issue. For some reason, I get the error listed below in the screen capture. Through trial and error, I was able to determine the fix is to simply open each interface/sub-interface and save (without making any changes) and the issue goes away and I am able to push to the firewalls. On the firewalls, I am deleting the default rulebase, zones, and interfaces before pushing from Panorama.   ... View more

I am in the middle of migrating a very large Cisco ASA with ver 9.3(3)6 and noticed that the NATs are causing all kinds of issues. As an example, the security policy migration should have created a single rule from a source group to a destination group for each of the ports listed in the ACL's (the Cisco did not have a group for the ports so instead had about 10 ACL's with the same source/destination for each port). Instead of ending up with about 10 rules in the conversion I instead ended up with about 200. The 10 rules I expected are indeed there but for each port in the ACL, there are about 20 additional rules with 10 being the same source/port and the other 10 being the same source/any port and ALL of the extra rules have different destinations than the original ACL.   I have no idea what is happening here but my only thought is to just remove the NAT rules from the ASA config and start over then do the NAT rules 1 at a time by hand (was trying to avoid that as it has almost 800 NAT rules). Is NAT conversion just not working from this version of the ASA?   Let me know if you need additional info as I am sure that description isn't easy to understand. ... View more