About alestevez

Security Policy View Expedition will put in read-only mode the Security Rules when the VSYS or DEVICEGROUP selected from the bottom bar is "all" to avoid you can multiedit rules from different VSYS or DEVICEGROUPS, so to enable the Edition you must select a VSYS or DEVICEGROUP other than "all" like "vsys1"      ... View more

What is Expedition?   Expedition is the fourth evolution of the Palo Alto Networks Migration Tool. The main purpose of this tool was help reducing the time and efforts to migrate a configuration from one of the supported vendors to Palo Alto Networks.   By using the Migration Tool, everyone can convert a configuration from Checkpoint or Cisco or any other vendor to a PAN-OS and give you more time to improve the results. Migration Tool 3 added some functionalities to allow our customers to enforce security policies based on App-ID and User-ID as well.   With Expedition, we have gone one step further, not only because we want to continue helping to facilitate the transition of a security policy from others vendors to PAN-OS, but we want to ensure the outcome is the best as possible. This is why we added a Machine Learning module that can help you generate new security policies based on real log traffic and the introduction of the Best Practices Assessment Tool to check the configuration complies with the Best Practices recommended by our security experts.   With all these huge improvements we expect the next time you use Expedition the journey to the excellence will be easier.   NOTE: Expedition is supported by the community as best effort   The Palo Alto Networks TAC does not provide support, so please post your questions in the community.   Go to: Expedition landing page on LIVEcommunity ... View more

In Expedition, there are many different ways to setup a filter. Let's start from the beginning.   Case A) Project Dashboard:      Project Dashboard   When you click on one of the counters from the PROJECT STATISTICS Expedition will set a filter and will jump into the object selected. If you click on services Duplicated counter this is the filter will take action plus you will be transported to the Services view Filter Window   Case B) Predefined Filters   From any objects view when we press right-click an advanced menu will be shown, one of the options its called predefined filters, just open the list and select the one you want to automatically create and apply the filter.   Right-click over one service     Each type of object can have their own predefined filters but usually they are common between them   Case C) Custom Filters   Click on Filters from the Objects or Policies view to get access to the Filter assistant Access to Filter Assistant     A new window will show up. From here we can create our custom filter   Scope: Where this filter will apply, The more number of objects you add to the scope will reduce the amount of fields common between them to be able to search by, like if you select as scope address and addressgroups you can search only by name, tag and description because those are the fields in common, if you only select address all the fields related to address can be used to search like ipaddress, cidr, etc... Field: the field we want use to filter Operator: It can be equal, or contains, etc What to search: Text we want to search on the selected field. to CREATE the filter click on the plus button Creating custom filter   To Apply the new filter we have to select the filter from AVAILABLE and DROP into ACTIVE folder Click on APPLY FILTER Edit Custom Filter   From the Objects and Policies views, you can see if there is any Active filter and Clear them all     Remember when creating a custom filter, first add to the available filters and then drop it into the ACTIVE to apply the filter. ... View more

Explore the Expedition Dashboard   Expedition Dashboard   There are 2 parts related to the VM Stats, one controls the stats for the local VM running the GUI and the ML Health in case is running on another VM shows the stats from the remote Expedition VM.   That means you can setup 2 Expedition VMs and use one for the GUI and another with more CPU and RAM to run the data analysis and machine learning. If this is your case just go to SETTINGS -> M. Learning and setup the IP address where your Expedition with more resources is running and click on SAVE.   The Task Manager must be always UP and controls all the backend jobs requested from the GUI like to retrieve contents from a device using the API keys.   Expedition comes with a self-check list to at least show you if there is something that can be improved in the system or if some dependencies or required functions are working properly or missing.   Close to the logo you can find the version and the released day plus what version of the Best Practices Assessment Tool is running. ... View more

There is a time when you already started a project and then you need to import the configuration from one device you didn't created yet.   From the Expedition Dashboard, go to Devices and add the new device. After generate the keys and import the contents go to the Projects view Select your project and click on settings Go to Devices Select the firewall you want to bring to your project Click on the Arrow that points to the Right Click on Save   Project's Settings View   Now when you enter into your project and navigate to the Import tab you will see the device to be imported.    ... View more

Expedition comes with a framework to manage the Role-Based Access Control, this will help you to add users with different level of privileges.        1) Expedition User Roles:                 a) Super User: This Role allows the User to manage everything on Expedition              b) Admin: This Role allows the user to Create projects and devices but cannot change system settings or add new users              c) User: This Role allows the user only to enter on Expedition and see projects and devices where has been granted access.        View of adding a new user to Expedition          2) Project User Roles:             When a project is created by an Expedition Super-User or Admin, this can be edited by clicking on Settings   View of Expedition Project Settings           From the Settings window, we can add Expedition Users to the Project. Inside the Project, we have different Roles:           a) admin: This Role can change the Project Settings and modify all the content within it.         b) user: This Role can edit the project contents but it cannot change the project settings to add more devices or users to the project.          c) viewer: This Role is for read-only purposes. Doesn't have any privileges to change nothing inside the project or manage the project settings.    View of Edit Project panos to add Expedition users.       As an example, you can create a new Expedition user with Role (User) and attach this user to one Project as (admin), in this case the User be able to manage only the project and the content but it will be unable to add more projects, devices or users to Expedition.     Hope this helps to clarify how to assign Roles.   ... View more

Expedition comes with a built-in messaging queue system.   This mechanism allows it to prepare some tasks and send it to the queue. With this, we can run jobs internally without having to wait until the job is finished in the same page we are.   The first thing you will have to do when you enter in Expedition is check if the process is UP or DOWN, click on START in case is DOWN. If this is DOWN the Jobs will not be executed until it get's UP again. Dashboard  Some of the tasks relaying in the TASK MANAGER are: Download contents from Devices Auto-Zone Function Retrieve dynamic reports from firewalls for App-ID and User-ID adoption Machine Learning     Debug: If you want to see the output generated by the jobs running from the Queue you can see the content here:   tail -f /home/userSpace/panReadOrders.log     ... View more

Some times we need to reduce the amount of Objects to be migrated or just for optimization and there is one technique that can help us to reduce objects   Its common when we have used Expedition to migrate a configuration from CISCO or FORTINET to have address objects named as H-X.X.X.X or N-X.X.X.X-XX or even if the name was just an IP Address, but they were created as Address Object and count as Object. There is one function inside Expedition to convert them as IP Address that will be only Used on Rules as IP Address or IP Ranges hard-coded as Source or Destination on Rules. So they will not be used as Address Objects anymore.   This has pros and cons but if our Goal is reduce the amount of Address Objects this can help us.   Search from OBJECTS -> ADDRESS with right-click in one Address select the Predefined Filter called "Name is IP address". This will search the Address where the name is an IP Address.         We can add more filters to this process, Select the Filters Options and add all the Address where the name starts with H- for example, and the objects that starts with N- and the objects that starts with RANGE-, put the focus only on Address.         After Run SQL select the Address you want to transform to an IP Address and right-click with your mouse over one of the selected Address and select the option "Transform" -> "Object To IpAddress" and automatically all those objects will be renamed with the IP or Range Address (netmasks will be added as well in case are not /32) and will be marked internally as "dummy" objects, those objects will not be considered at the time to generate the XML or API Calls.       You can check before to transform them as IP Address if they are part of any group by going to TOOLS and SEARCH & REPLACE.                  ... View more

Some times we need to reduce the amount of Objects to be migrated or just for optimization and there is one technique that can help us to reduce objects.    In this case we will search if in our config exist any Address-Group with just one Member. If exist we will replace the Address-Group by the Member in any place we find it used. It can be used as part of another Address-Group or can be used as source or destination in any Policy.   Procedure:   Search for Address-Groups with one Member: Go to Objects and point your mouse on the Address-Group Panel and over one Address-Group right-click with your mouse and select Predefined Filter and select the (Predefined) Groups with one Member.   Select the Tab TOOLS. From the right Panel select SEARCH & REPLACE.  Expedition will show you where those Address-Groups where used. Select from Address-Groups and Policies where they were used and click on Add to Replace   Now click on the Tab called REPLACE, now for all the objects selected we will apply on the option Replace by the option Members and click on the Replace All button at the bottom of the page - right.      After the action completes we can go back to OBJECTS and check if those Address-Groups now are shown as unused. In case afirmative you can then safely remove them.        ... View more

Question Can I export my project to another Expedition instance? Answer Yes you can!   Export a Project:    Warning: Only Expedition Super-Users can Import and Export Projects.   Login to your Expedition Go to Projects Tab Select the project you want to export and click on Settings Projects View        4. Go to the Import/Export sub-Tab      5. Click on the Export button.       6. Click on Save   Import Export View   Import a Project:      1. Create a new Project     2. Click on Settings of the project     3. Go to the Import/Export sub-Tab     4. From the Import fieldset click on Browse to select the project to import     5. Click on Save   Warning: In case the project already exists the content will be replaced by the new one, whatever it was in the project will be replaced with the new content.     The log connectors will be removed from the project because they reference devices that may not exists where you are importing the project.   Import Export View   ... View more

Symptoms Im trying to login to Expedition but the browser says 'Incorrect user or password' but they are correct. What's going on? Diagnosis Behavior seen in Chrome by now. Solution The web browser needs to restart the connetion with Expedition. to do it just reload the web page with the IP address of your Expedition VM and then you will be prompted to allow the certificate again, the session will be then re-established and everything will work again. ... View more