About RobertWalton

Expedition ver 1.1.98   Case: Migrating 2 ASA configs to single PA. After cleanup on both ASA configs removal of dups and invalids.  Merged the configs to the base config from a set of clean 3250's. Generated .xml and set commands. Downloaded, imported and loaded. Navigate to commit - validate receive the following errors:   vsys -> vsys1 -> service -> tcp-tacacs -> tag 'merged' is not a valid reference vsys -> vsys1 -> service -> tcp-tacacs -> tag is invalid vsys -> vsys1 -> service -> udp-tacacs -> tag 'merged' is not a valid reference vsys -> vsys1 -> service -> udp-tacacs -> tag is invalid vsys -> vsys1 -> service -> tcp-domain -> tag 'merged' is not a valid reference vsys -> vsys1 -> service -> tcp-domain -> tag is invalid vsys -> vsys1 -> service -> domain -> tag 'merged' is not a valid reference vsys -> vsys1 -> service -> domain -> tag is invalid   To clear this issue I have to pull the pretty.xml from the .zip download and locate all of the tags for:   <tag> <member>merged</member> </tag>   From each service.  Once this is completed save the new .xml and repeat the process to import, load and commit - validate   Validate comes back clean.  Can now commit config and complete migration of ASA to PA.   Just an FYI for anyone who runs into the same issue.  I am not positive if the "merged" tag originated because of the actual merge to base config or if this is a result of removing a tag that was being deprecated and then the merge generated the empty field "merged" for a placeholder. ... View more

Hello Community,   I have a client that wants to do a multiple asa configs into a single pair of 3250's that will be pulled into their Pano when migration config has been confirmed and validated.   Do I have anything to worry about when I pull the devices into the Pano?  Such as duplicated/shared objects?  My understanding and experience is that the Pano will create a new device group, template stack and base templates from the imported devices.   Then if there are any conflicts such as duplicate objects they can then be cleaned up on the pano and the templates.   Background:  We had to cancel a cutover last weekend due to the fact that the client pulled in the 3250's to Pano and pushed templates before the configuration was imported from Expedition.  This caused a huge issue with dup address, service, zones etc.   To address this failed cutover, I reached out to the acct. mgmt. team and we removed the devices from Pano, copied the objects from pano to the device to address the cleanup that needs to be done.  I exported that config and pulled into a new expedition project for clean up.  I will then after review import that config into the 3250's.   Clean up on the pano is to remove the previous devices, group, stack and templates.  Providing for a clean landing space for re-importing the devices.   Has anyone been through this type of migration and are there any points that I have not made concessions for?  Any and all input is appreciated. ... View more