About justamoment

<sigh> It was caused by Apps/Threats being out of date.  Once I got it up to the current version it committed fine.   Now the real cleanup beings - thanks for all of your help! ... View more

No change - it still fails a Device Push validation. ... View more

Panorama committed just fine.  It's the Device Push (validation) that fails.  Is this still something to try? ... View more

Looking at the rule in question, the rule is fine - I don't see anything wrong with it.   I have confirmed it is only the ASA objects as found in merged ASA security & NAT rules. ... View more

So, it's looking like my shared address/group objects from the ASA are all corrupted now.  I didn't scroll down the entire validation output but it's a very long list about    rulebase -> security -> rules -> Rule-01 -> source 'object-XYZ' is not an allowed keyword rulebase -> security -> rules -> Rule-01 -> source object-XYZ is an invalid ipv4/v6 address rulebase -> security -> rules -> Rule-01 -> source object-XYZ range separator('-') not found rulebase -> security -> rules -> Rule-01 -> source 'object-XYZ' is not a valid reference rulebase -> security -> rules -> Rule-01 -> source is invalid   When I check the address object in the Panorama CLI, it looks like this (GUI is similar):   set shared address object-XYZ ip-netmask 1.2.3.4/32   Similarly, for a group object and its members, it all looks fine.   In the case of a group object, there were two that I deleted and re-created identically and then they worked. ... View more

So, is there a way to update a Panorama (or firewall) XML or does one have to start a new project? ... View more

Oops, should have refreshed before replying.   makes sense although i already did it.  Object-wise, there isn't much to worry about in our Panorama configuration - just a duplicate address group.   So if I did need to keep an edited XML, would I first merge the newer XML and then merge the ASA config? ... View more

Never mind - I figured that out.   Highlight PAN Base Config on right, click RED Unset Base Config button.  This moves it to the left side. Check box for newer PAN XML on left, click BLUE Set Base Config button. Check box for older PAN XML on left, click TRASHCAN icon to get rid of it. ... View more

When i go to the Export page, only the old XML file is present.  I don't see a way to switch it to the newer one. ... View more

Oh, I take that back somewhat - that created a new XML choice in the lower-right corner.  Is there anyway to get rid of the old one? ... View more

Re-import Panorama in the Project 🙂 ... View more

Sorry, what I meant is that since I first started this Project iteration, Panorama has been updated.  Apparently, I missed a step in updating Expedition for the changes.  I did the Devices | Contents | Retrieve Contents but I seem to recall that I might need to do something else in the Project itself like re-import Panorama. ... View more

I spoke too soon - I just tried to commit to Panorama to save my work until morning and I'm gettting 30 validation errors.  I think I might know why it's happening though.  It looks like all of them are objects that disappeared.  I bet I didn't update Panorama correctly in Expedition after recent changes.  I'll have to re-watch that video and test it out. ... View more

So far things you've pointed out have helped immensely.  After a number of iterations I'm getting a better handle on how this all works.   I still have at least one more iteration as I've been getting a lot of send API command errors.  It would be nice if the sends would just continue on and report any errors found rather than just stopping at the first one. ... View more

Understood but if I have shared objects, how do i find those to send those API calls first?   (I did some edits and then removed them because I wasn't looking in the right place) ... View more