About sidetrack

Hi Sidetrack,    Sorry to dig up an old post.    I am in a similar position but fortunately only have one site to rename the zones to match the org and panorama. If you have a moment could you please share your findings and what process you took?   Many thanks, Ben     ... View more

@alestevez I'm considering trying to do this in the DB instead, if there's a way I can dump the table that contains the invalid 'shared' polciy and import it into the vsys1 table?   Any hints? 🙂   Matt   ... View more

Yes, please. Share those with us at fwmigrate at paloaltonetworks dot com. We will take a look into it ... View more

Thanks for raising this, I have had the same question only to find out by trial and error. With the merge function I have found if an element can only have a single entry or configuration the name of which already exists in the config, it effectively REPLACES that element in the destination x-path. Where an element can have multiple entries (e.g. groups) the merge function will COMBINE the existing config with the new. Understanding this is helpful in case you have existing elements with the same name.   I believe the Append function is designed for policies only, where the imported config is tacked on the end of the existing althouhg I would expect this to have the same result as a merge, especially when an existing rule has the same name (you can't have two rules with the same name even in a candidate config - the 'new' rule is probably going to merge with or replace the existing - I would suggest more trial and error or more consise documentation from PAN 🙂   I have done all my optimisation off-site so never had API access to the customer equipment, should that be the case I have no idea what would happen when pushing the conifg to Panorama via the API - would this merge, append or replace the destination element / stanza? ... View more

I've done this in Panorama without using Expedition, by loading partial configs from one DG to another by loading a partial configuration from the source device group in the running-config as per https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-move-or-copy-objects-in-configuration-from-one-location/ta-p/71904   You need to start with the dependencies i.e. tags, addresses, address groups, apps, app groups, profiles, profile groups etc. then you can copy the policy. You can copy all pre- or post- rules at once by using the pre-rules or post-rules Xpath.     I found an old tech note for PAN-OS 6 quite helpful for this process https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Panorama-Device-Migration/ta-p/62527 even though the device migration process is largely automated today. ... View more