About ROHO

ROHO · ‎12-04-2018

@Crispim I'm not sure if I understand correctly, on the PA-850, are you able to use 1G copper SFP on ports 5-8 (1G SFP only), and get link up?

ROHO · ‎11-07-2018

The migration tool is building the security policy based on the private IP, post-NAT. PAN matches based on pre-NAT, public IP. In the NAT rule, the Security Rules Match does not have an entry. The first 4 reviewed has the same behavior. What's interesting is that the migration tool prepends the NAT rule name with "Nat Twice" Not sure if there is a reasoning for it.

ROHO · ‎11-07-2018

Not sure if anyone else ran into this. ASA's security policies are built based on post-NAT rules (post 8.3 OS) With the tool, it builds the same rules with the post-NAT rules, private IP ... which will not work with PAN as the rule is built based on post-NAT, public IP. Is there an option in the tool to convert the IP to pre-NAT?

ROHO · ‎11-05-2018

Noticed that many rules with source ports defined are not migrated over. Instead, it creates a service only for the destination port/range and allows all ports through. Below are a few rules. Is it a known behavior? The first two allowed all udp and tcp ports > 1023 The third rule allowed all TCP ports access-list OUT2IN extended permit udp any4 eq domain any4 gt 1023 access-list OUT2IN extended permit tcp any4 eq ftp-data any4 gt 1023 access-list OUT2IN extended permit tcp any4 eq ftp-data any4

ROHO · ‎11-01-2018

We have quite a few Invalid Services. The only way to remove them is to remove all Unused Objects. Is there a way to just remove the Invalid Services without having to remove all Unused Objects. Looked in the ASA config and for the most part, they do not exist.

ROHO · ‎10-29-2018

FYI, I rilled back to Expedition version 1.0.105, and it is working now.

ROHO · ‎10-29-2018

Yes, upgraded last week and am running 1.0.107. Are the following steps correct to run the BPA? Am sure I am missing something simple - create new project - import the pan config - click Best Practices at the top, assuring that correct file is selected in the bottom right - click Start Analysis

ROHO · ‎10-29-2018

When you created the custom group, did you add it under Snippets? If so, what "Type" did you use? Did you leave it as default, All Types?

ROHO · ‎10-29-2018

Am trying to run BPA from Expedition against a PAN baseline config. Imported the config and clicked on Start Analysis from the Dashboard. It says it is complete, but is 0% for everything. There is no content/results in the Analysis, Security Policies, and Threat Practice section.

ROHO · ‎10-29-2018

Do you have to create a snippet of each of the profiles, in order to create the custom group? Am trying to avoid that and just create the group. Reason is, the baseline config already has all of the profiles, and I didn't want the tool to overwrite it. Thanks!

ROHO · ‎10-29-2018

Converting from ASA to PAN. Is there a way to apply a Security Profile Group to a large # of security policies. One can only create a snippet for the individual profiles but not for a group. Tried to edit the policy itself and manually add a group name. It took it, but when we open the policy back up, it is not there. One mentioned to crate a custom one. Tried that, but what "Type" was slected? There isn't a csutom one that we can file for a security profile group. The PAN baseline config already has all the profiles and the group..

ROHO · ‎07-10-2017

not too concerned about arp; only mentioned it as it was a few items, of many, that we need to use ping for basic t/s. just wanted to see if anyone on this community has seen this feature in the roadmap. would be nice to use one UI for everything !!

ROHO · ‎07-07-2017

hi, is the ping feature available in the UI, or at least on the roadmap? we have users that don't allow SSH to the box and they need ping to refresh arp entries to the hosts or basic t/s. thanks!

Member Since	‎05-23-2017 02:29 PM
Date Last Visited	‎02-18-2025 05:42 PM
Posts	16

Online Status	Offline
Date Last Visited	‎02-18-2025 05:42 PM

About ROHO

Re: SFP + modules for PA 5220

Re: ASA to PAN - Security Rule Based on pre-NAT Issue

ASA to PAN - Security Rule Based on pre-NAT Issue

ASA Migration - TCP/UDP source port rules not migrated

ASA Migration - Remove Only Invalid Services that are Unused

Re: BPA Tool Not Running?

Re: BPA Tool Not Running?

Re: Adding Security Profile Group to Policies

BPA Tool Not Running?

Re: Adding Security Profile Group to Policies

Re: Adding Security Profile Group to Policies

Re: SFP + modules for PA 5220

Re: ASA to PAN - Security Rule Based on pre-NAT Issue

ASA to PAN - Security Rule Based on pre-NAT Issue

ASA Migration - TCP/UDP source port rules not migrated

ASA Migration - Remove Only Invalid Services that are Unused

Re: BPA Tool Not Running?

Re: BPA Tool Not Running?

Re: Adding Security Profile Group to Policies

BPA Tool Not Running?

Re: Adding Security Profile Group to Policies

Adding Security Profile Group to Policies

Re: Ping Feature in UI, not CLI

Ping Feature in UI, not CLI

Unlock your full community experience!

About ROHO