About Eric.Hernandez

I have certificates located in a template in a Panorama instance. I would like to 'copy' the certificate data (CA flag, private keys, etc) over to a new template within another Panorama instance.     I understand that I can export the cert + key, and import manually into the new template. This is part of a larger migration and I'd like to use the 'load config partial' command to copy the data over. I've already taken a configuration snapshot from my source panorama, and imported the configuration snapshot into my destination panorama.     This works fine if I wanted to grab the (source) PANORAMA certificates, but for some reason, I can't pull any cert data from the (source) template. When running the commands, I'm getting an error stating that the "input file doesn't have anything at..." If I use the API browser, I can indeed see that there is no output on the screen, when I navigate to where the certs are located in my source template:   devices/entry[@name='localhost.localdomain']/template/entry[@name='Global+Template']/config/shared/certificate   I can drill into the template, but I don't see anything where I should see the certificates. If I look at the Panorama certificates, I do indeed see the certificates within the API browser? Does anybody know why this is happening? Any suggestions for a workaround?     For more context, I am essentially looking to 'copy' templates from a source panorama to a destination panorama. I've been using SET commands (get the SET commands from the source, and enter them into the destination), but manually copying the SET syntax for the cert is not working.     If there's a way to copy over the ENTIRE template via load config partial, then I'm all ears.... If anybody has any other suggestions, they would be highly appreciated. Thanks! ... View more

I am using an HTTP profile to send PANORAMA CRITICAL SYSTEM events to Slack. The integration is working well.      My Panoramas are an A/P HA cluster. The issue that I have is that I'm unable to delineate the device names via the HTTP profile payload (because the HTTP profile payload gets duplicated between both the active and the passive device).     Here's my HTTP profile SYSTEM payload:     {"text": "*Panorama System Log*\n *Device Name*:$device_name\n *Receive Time*: $receive_time *Severity:* $severity *Type*: $subtype\n *Log Message:* $opaque"}       This works well except for the $device_name variable (variable i.e.: system log field).  For my Panorama instance, the $device_name returns IP address 1.1.1.1. I would expect it to return the device's hostname.      In reviewing the System log fields documentation, https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/system-log-fields.html#id9502d0c7-67d3-4f74-a0a9-3fdd671afd28      the field "device_name" is described as "the hostname of the firewall on which the session was logged". The key word here is "firewall" as this does not seem to function correctly for Panorama.      In a nutshell, I want to include the Panorama hostname (or Panorama mgmt IP address) within the log(alert) output. That way I know which device in the HA pair is generating the log/alert. For a Panorama A/P HA pair, the HTTP profile payload is duplicated across both devices, and therefore I cannot hard code the device name in the payload, I need to use a variable (i.e.: system log field name). Does anybody know how I can get the Panorama hostname or mgmt IP address to show up in output? How would I build the HTTP Profile SYSTEM payload? Any ideas are appreciated. Thanks!              ... View more

I've installed the Expedition 2.0 beta in a VMware Ubuntu 18.04.5 instance. I understand that this is a beta version, but it seems blatantly broken.    The first issue that I'm having is that my Expedition instance is failing the health check, and the remediation step is not helping.    The following variables for Expedition are missing: Spark.RAM,NumCPUs,TotalCPUs    The remediation is:    Delete the /home/userSpace/environmentParameters.php to get it regenerated   I've performed the remediation step and the health check has not changed (even after a reboot).  My VM has 2 virtual CPUs (1 socket, 2 cores).      The other item has to do with adding a device. I cannot add the device via GUI, When I try via GUI, I receive the error, "Something went wrong, please try again". This is consistent regardless of what device I try to add (Panorama or NGFW, physical or virtual).    Oddly enough, I can add the same devices via API.    I've added my Panorama instance, and I've retrieved the contents (i.e.: licenses, etc). Where it gets wonky is when I try to get the "Panorama Devices" (i.e.: get all the FWs managed by the Panorama instance). This works fine in Expedition 1.0. In the beta edition of 2.0, it just hangs indefinitely when I try to download the running config.      Does anybody have any suggestions? I have a large upcoming project and I'd like to play around with rule analysis, specifically RE and ML. I don't want to use Expedition 1.0 as the OS (Ubu 16.04.7) is just about deprecated and sec compliance is a big deal in my org (and rightfully so - I wouldn't be here otherwise).      Is anybody successfully using Expedition 2.0 beta yet? Any insight is appreciated. Ty.  ... View more

I'm using expedition 1.1.93   When I target my any/any rule for app-id adoption, the adoption process finishes, but no app-ids are displayed. This occurs whether I request a slow retrieval or a fast retrieval.     The same rule(s) work fine with ML and RE (app-ids show up as expected).     Any ideas? I'm not even sure how to troubleshoot this. Any help is appreciated. Thanks!   ... View more