About santonic

santonic · ‎08-07-2024

Hello. I need to migrate switch (Cisco 9500, version 17,12) to PA firewall. I tried importing config into Expedition but i didn't get any rules nor L3 interfaces. All layer 3 configuration is on VLAN interfaces, ACLs are attached to this VLAN interfaces. Example: interface Vlan21 ip address 10.x.y.252 255.255.255.0 ip helper-address 10.x.y.35 ip directed-broadcast 101 ip access-group USERS in standby 21 ip 10.x.y.254 standby 21 priority 110 standby 21 preempt standby 21 authentication md5 key-string 7 aaaa timeout 30 ! Is it possible to use Expedition for this? Would any changes in exported configuration make this work? Any help would be greatly appreciated.

santonic · ‎06-12-2024

Exactly the same problem (Failed to get content for 'base--candidate'!) on Panorama 10.2.8. Anyone opened a case with PA support for this? Seems to be an old issue but no official info about it anywhere.

santonic · ‎02-26-2024

I don't have a TAC case open yet. Can I even open a TAC case for Expedition issues? Or how did you mean this?

santonic · ‎02-26-2024

I think this is PA (or TAC) responsibility. In this scenario you are just consuming their Cloud NGFW service. All the work under the hood should be handled by PA. Especially as this is managed via Panorama plugin and not as usual VM instance.

santonic · ‎02-21-2024

For the source zone I can understand. But for the destination zone destination network was defined, it's a directly connected network, and Expedition set it to 'outside' anyway. It should be the destination zone of directly connected network.

santonic · ‎02-21-2024

Thank you for your reply. Ok, I tried this but it seems it's not taking into account directly connected networks. Tested it on a rule from one connected (source zone A, no source IP defined) to the other connected network (destination zone B, destination network defined) and it changed source zone to 'any' and destination zone to outside (where default route points).

santonic · ‎02-06-2024

Thank you very much. Wasn't expecting that something which is supported on 3200 series wouldn't be supported on 3400.

santonic · ‎02-06-2024

I am migrating a configuration from PA-3200 series device on PAN-OS 10.1 to PA-3410 where minimum version is 10.2. On migration I noticed error messages about destination interface in QoS configuration: network -> qos -> interface -> ae3 -> regular-traffic -> groups -> regular-traffic-group -> members -> aaaa -> match -> local-address -> destination_interface unexpected here. Discarding. network -> qos -> interface -> ae3 -> regular-traffic -> groups -> regular-traffic-group -> members -> bbbb -> match -> local-address -> destination_interface unexpected here. Discarding. And on closer inspection I can see that on PAN-OS 10.1 we had an option to set destination interface for QoS configuration and in 10.2 there isn't such option. Was this option omitted in PAN-OS 10.2? Is it platform specific? Though 3400 should support everything 3200 does and more. Or is it maybe some sort of a bug?

santonic · ‎12-11-2023

Thank you all for replies and TAC won't be needed. It was the case of wrong XML code for the Security Profile Group I created in Expedition (and left the XML field empty). After adding simple XML code for an empty Security Profile Group I was able to create output files.

santonic · ‎12-08-2023

Could it be that I created a custom Security Profile Group as a placeholder without any XML code? In that case what would be the minimum code required?

santonic · ‎12-08-2023

I am doing ASA to PA migration. After editing the original configuration and importing base image I am ready to merge and export. Merge works fine and doesn't show any errors. But every time i click Generate XML & Set Output it gets stuck. I've tried in different browsers, I've tried with different base configs, I've upgraded Expedition to the latest version, rebooted server... but nothing helped. It doesn't report any errors it is just stuck there Usually it's stuck with text saying Generating Profiles vsys/dg;vsys1 How can I fix or troubleshoot this, please?

santonic · ‎11-28-2023

Ok, thanx for the info. But I think I have some deployments, where certificate is required to connect to gateway but not required when connecting to portal. But as I said I am not certain, I will have to check.

santonic · ‎11-23-2023

Hey @Cbrasolin . I'm afraid I don't remember how this story ended back in 2018, I guess I'm getting old... 🙂

santonic · ‎11-03-2023

Ty for the info. Well I only have 2, not 3. But both connected so I guess everything is in order. And I guess more will spin up as needed based on throughput needed.

santonic · ‎11-02-2023

In the end it turned out it was just a connectivity issue; I got confirmation from customer that VNET with Panorama wasn't connected to the HUB where Cloud NGFW was deployed. Later they connected it and everything seems to work now. However I now see 2 connected devices (VMs). Is it normal that a single deployment of Cloud NGFW shows as 2 VMs? The other explanation might be that we re-deployed Cloud NGFW again under same name and with same DG and template names. But the old deployment is now removed from Azure and I still see both VMs as connected.

Member Since	‎01-26-2011 05:56 AM
Date Last Visited	‎08-12-2024 09:48 AM
Posts	671
Total Likes Received	191

Online Status	Online
Date Last Visited	‎08-12-2024 09:48 AM

About santonic

Importing (Cisco) switch configuration to Expedition

Re: Config Audit Failure

Re: Expedition - re-assign zones after change in routing

Re: Panorama management for Cloud NGFW

Re: Expedition - re-assign zones after change in routing

Re: Expedition - re-assign zones after change in routing

Re: QoS configuration based on destination (sub)interface on 3400 series

QoS configuration based on destination (sub)interface on 3400 series

Re: Can't generate output files

Re: Can't generate output files

Re: Can't generate output files

Re: Browser not prompting/selecting client cert for GP portal

Re: Panorama management for Cloud NGFW

Re: App Identification and ALLOW rule - does this make any sense?

Re: What is PA equvalent to show Xlate to view NAT translations

Why is SMB traffic slow ?

Re: Expedition - re-assign zones after change in routing

Re: Panorama management for Cloud NGFW

Re: Why is SMB traffic slow ?

The World’s First ML-Powered NGFW

Importing (Cisco) switch configuration to Expedition

Re: Config Audit Failure

Re: Expedition - re-assign zones after change in routing

Re: Panorama management for Cloud NGFW

Re: Expedition - re-assign zones after change in routing

Re: Expedition - re-assign zones after change in routing

Re: QoS configuration based on destination (sub)interface on 3400 series

QoS configuration based on destination (sub)interface on 3400 series

Re: Can't generate output files

Re: Can't generate output files

Can't generate output files

Re: Browser not prompting/selecting client cert for GP portal

Re: Browser not prompting/selecting client cert for GP portal

Re: Panorama management for Cloud NGFW

Re: Panorama management for Cloud NGFW

Nebula Hardware Beta

Nebula Beta

Unlock your full community experience!

About santonic