duplicate services with underscores after import to R80.10

[Jacques_Spelier]

Hi there,

We did an advanced upgrade from an R77.20 SMS to R80.10. The import was successfull but we ended up with a bunch of duplicate service objects and terminate with an underscore. Too many to list. Example of http are attached. Upon policy pushes, we get the "Match ANY...." warning messages.

 I opened a case and was told that the "_" objects are the old R77.20 services. SK115995 is similar to what I am experiencing. Unfortunately our policies are using the underscore objects and we can't simply delete the duplicates. My questions though is what objects am I to keep and is there a way to fix this?  As you can see from the captures, the underscored object seems to present more configurable option. I am unsure on what impact removing one object vs the other will have on Threat Prevention Blades. We are moving to have URL, APP, AV and Antibot turned on next quarter.

Any feedback is appreciated. 

[PhoneBoy]

Note the reason you are seeing this "underscore phenomenon" on upgrade is that you changed the default services in some way.

In R80.x, you cannot delete or adjust the default services by design. 

Generally I would use the new services in R80.x and replace the underscore services with their R80.x equivalents in your rules, but you should do a visual inspection of the services in question.

If you need HTTP on a different port (for instance), you can always create a new service like so:

One way you can easily replace these "underscore" services with their equivalents is to use the "Where Used" functionality, which gives you the ability to do a Replace.

Right click on the service object and select Where Used.

You can then choose to replace it with the non-underscore version.

[Norbert_Bohusch · Accepted solution]

Btw. this behavior is documented in sk117237 (R80.10 Pre-Upgrade Verifier notifications and their solutions)