topic Re: Expedition App-ID Adoption in Expedition Discussions

Expedition App-ID Adoption

Gene_Barden — Thu, 20 Jun 2019 17:57:52 GMT

Trying to use Expedition to migrate port based rules to App-ID. I have imported the Panorama running config and added the Log Collector Plugin. I clone the rules and then select App-ID Adoption to retrieve Apps on my selected rules and Expedition generates the report but I never see any Applications populated. I aslo should add that we are using Cortex Data Lake for Logging in Panorama.

Re: Expedition App-ID Adoption

sjanita — Fri, 21 Jun 2019 20:50:50 GMT

with Cortex, you must use the app-ID adoption Fast option. The app-ID adoption slow option is not currently supported.

Re: Expedition App-ID Adoption

Gene_Barden — Fri, 21 Jun 2019 21:06:27 GMT

I will give that a try and respond with an update.

Thanks!

Re: Expedition App-ID Adoption

Gene_Barden — Fri, 21 Jun 2019 22:04:17 GMT

I should add that I am VPN'd into the customer network. Will the App-ID adoption work across VPN?

Re: Expedition App-ID Adoption

sjanita — Mon, 24 Jun 2019 08:24:52 GMT

are you running Expedition on your laptop/local machine and accessing the cloud based Panorama via the VPN?

this connection should not cause an issue. The important connection is with Panorama connecting to the Cortex data lake to query the traffic log.

Re: Expedition App-ID Adoption

Gene_Barden — Mon, 24 Jun 2019 12:46:27 GMT

Yes, I have Expedition running on my laptop and am VPN'd into network. Panorama is installed on premise at customer network and connected to Cortex Data Lake. Panorama queries Corext Data LAke with no issues. However, when I run App-Id adoption to retrieve apps fast for Fast the quesry runs but nothing ever happens. I have selectred specific rules that I know are getting hits.

Re: Expedition App-ID Adoption

sjanita — Tue, 25 Jun 2019 14:19:27 GMT

go ahead and send an email to fwmigrate 2 paloaltonetworks.com and we can schedule a time to run the debug on the query. Please reference this discussion when sending the email.