About dpuigdomenec

dpuigdomenec · ‎04-02-2024

Hi @BrianMarks Thanks for reaching out. Please execute the below commands to change the ownership of the folders /data (used to store the parquet files generated while processing the files) and /PALogs (used to store the raw logs coming from your devices). chown -R www-data:www-data /data chown -R www-data:www-data /PALogs/ Hope this helps, Thanks, David

dpuigdomenec · ‎03-26-2024

Version 1.2.86 (Date March 26, 2024) PACKAGE DOWNLOAD INFORMATION Link https://conversionupdates.paloaltonetworks.com/expedition-updates/expedition_1.2.86.all.deb sha1sum e5cc37f940cef7cb782725d92b64a4b67e3fc3c1 apt update sudo apt-get update; sudo apt-get install expedition-beta manual update cd /tmp; wget https://conversionupdates.paloaltonetworks.com/expedition-updates/expedition_1.2.86.all.deb; sudo dpkg -i expedition_1.2.86.all.deb; CHANGELOG Fixing below Bugs. These updates and fixes aim to improve the performance and functionality of the tool and parsers. Tool: API on PANOS 10.2.5 now functions correctly as the issue with single quotes in xpath has been resolved. Refactored merged rules feature with added logic to consider schedules and security profiles attributes. Updated installation script to address issues with rabbitmq-server installation and repository key prompts. Also, fixed Python installation script to support different Python versions without causing disruption. Note: To resolve any python library issue, please execute the script located at /var/www/html/OS/BPA/updateBPA306.sh. It will install python 3.7 but maintain python 3.8 as the default one for the Ubuntu OS. Parsers: Stonesoft FW and policy names with single quotes are now sanitized to prevent Expedition crashes, ensuring proper storage in the database and UI display, as well as accurate comparison when loading XML. Removed debugging printing in PALOALTO parser to eliminate PHP warning. Implemented a function to create new groups with a defined number of addresses and added it to all parsers to avoid reaching the maximum number of members in groups. Enhanced CISCO parser to address issues related to NAT rules and zone definitions, ensuring correct matching of security rules with corresponding NAT rules.

dpuigdomenec · ‎03-22-2024

Hi @ChanlyBob Our suggestion is to continue using the Expedition1 version for production. We will be releasing updates for bug fixes and requested improvements in the upcoming Expedition 1.2.86 version, scheduled for release early next week. However, there is no set date for the GA release of Expedition2. Best regards, David

dpuigdomenec · ‎03-22-2024

Hi @Jenifa With current Expedition version 1.2.85 you have 2 option: Do a dynamic group. Split into groups containing each 500 members. Both options are in the below menu on the address groups. Next Expedition version 1.2.86 will include the feature to auto split into groups when doing the migration. A custom setting will allow to set the limit or turn off the feature (by default).

dpuigdomenec · ‎03-18-2024

Hi @C.Pfitzer, @melvyn-guibout To be able to create properly the log connector, if the configuration is from a Panorama, on the device model select vm-panorama. Thanks! David

dpuigdomenec · ‎03-15-2024

Hi @Charlie80 You can create a project loading the FW configuration. Not based on the DG but on the FWs included in that DG. If an object is declared but not used on that FW context, then it will be showed as not used. Hope this helps and let me know if you have any other question, Best regards, David

dpuigdomenec · ‎03-14-2024

Hi @Charlie80 Expedition only takes into consideration unused objects those ones that are not used in any DG. In your case as the service is used in one of the DGs it will be showed always as used. Hope this helps, Best,

dpuigdomenec · ‎03-13-2024

Hi @melvyn-guibout Let me suggest some troubleshooting: 1) Check that the logs are analysed so you have a folder /data/ with the parquet files. That folder shall be owned by www-data:www-data. 2) Check that the serial displayed in the "Connectors" match with the serial on the analysed logs. 3) Check the generated logs in /tmp/ folder. ML Logs File Content /tmp/command.spark External cli command to execute spark /tmp/error_SecRulesLearn Standard output execution log for ML process /tmp/error_SecRulesLearn2 Error output execution log for ML process RE Logs File Content /tmp/command.spark External cli command to execute spark /tmp/error_SecRulesEnrich Standard output execution log for RE process /tmp/error_SecRulesEnrich2 Error output execution log for RE process Let me know if you need anything else, Best,

dpuigdomenec · ‎03-01-2024

Hi @JRichardson2 I recommend that the security rules and NAT rules contain the correct names of your zones before pushing them to your device. You can do that by renaming your zones or by doing a bulk change on your security rules updating the field zone to and zone from. Let me know if I can help in anything else, Best regards, David

dpuigdomenec · ‎02-29-2024

Hi @JRichardson2 Thank you for reaching out. In Expedition, you can manage Objects and Policies, which should be sufficient. However, please note that if your rules reference specific "zones", these zones must be declared in your device (Panorama). Otherwise, you will not be able to push or commit your configuration. The same applies to tags and other objects used in your Objects or Policies. To ensure best practices, please follow these guidelines: For network-related information such as interfaces and zones, use the "set" command on the CLI. For objects such as tags, addresses, address groups, services, service groups, applications, routes, security rules, and NAT rules, use the "load partial mode merge" command on the CLI. If you have any further questions, feel free to ask. Thank you!

dpuigdomenec · ‎02-29-2024

Hi @JRichardson2 Thank you for contacting us. Spinning icons indicate warnings on the specific rule. In your case, there are warnings on the rules. You can view these warnings in the warning tab or the Monitor tab. In the Monitor tab, you can also mark the warnings as fixed or remove them. For rules, a green icon represents an allow action, while a red icon represents a deny action. Regarding objects, a green circle indicates that the object is used in a rule, while a red circle means that the object is unused. If you have any further questions, please let me know. Thank you!

dpuigdomenec · ‎02-27-2024

Thanks for the update! Yes we updated the article yesterday to make sure it works. Let us know if you have any other issue, Best

dpuigdomenec · ‎02-27-2024

Hi @a.parmar Yesterday, we identified a problem with the script installer resulting in the incorrect installation of the rabbitmq-server component. To rectify this and install the missing component, kindly refer to the steps outlined in this article: https://live.paloaltonetworks.com/t5/expedition-articles/how-to-address-cve-2022-37026-vulnerability-in-expedition/ta-p/524133 Furthermore, we have updated the script to ensure that future installations will be successful. Let me know if you have any other question, Best

dpuigdomenec · ‎02-26-2024

Hi @santonic The requirement for the TAC case is solely for the purpose of file sharing. Despite Expedition not being an option in the product list, you can still initiate a TAC case (choose PANOS as the product). Make sure to specify in the description that the ticket is being opened exclusively for file sharing and may be closed thereafter. Thank you in advance,

dpuigdomenec · ‎02-23-2024

Hi @ChristopherMarston Yes, use any serial. In the ticket please add a reference that it is only required for sharing files purposes and it could be closed. Send the TAC case number to fwmigrate@paloaltonetworks.com. Thanks in advance! David

Member Since	‎04-07-2022 05:13 AM
Date Last Visited	‎04-23-2024 04:14 AM
Posts	206
Total Likes Received	30

Online Status	Online
Date Last Visited	‎04-23-2024 04:14 AM

Unlock your full community experience!

About dpuigdomenec