About danilo.souza

Hi @ch199soprano   Unfortunately not. I "whitelisted" the IP through Panorama. You have the option to create exceptions there (Objects->External Dynamic Lists->"Your List"->List Entries and Exceptions).   But It is not instantaneous. This can take up to one hour (the interval of time the Firewall takes to accomplish the autocommit).    Best Regards ... View more

Hi @xhoms   I executed the procedure, but you explicited lines with a successful registration and unregistration IP. Wich logs should I observe to get the details of a failed attempt to register an IP?   Best regards. ... View more

Hi @xhoms   I opened a ticket at PaloAlto and resolved the problem with the api key ("Invalid Credentials").   Inicially, I generated my keys through a Curl command from the MM machine. With the PaloAlto support, I used the browser and can confirm that the keys are barely different. I don't want speculate but I think my problem was an issue with Curl when generating my keys.   Later, I can detail the procedure followed to generate the new keys.   But, the problem is not resolved yet. I can't populate my DAG using the DAGPusher, but I can do that manually. In the figure below you can see that I uploaded two IPs. To do that, I used (in the browser ) the line below:   ---------- https://PANORAMA/api/?key=LUFRPT04OG---------VkJQbm9qTT0=&cmd=<uid-message><version>2.0</version><type>update</type><payload><register><entry ip="152.XXX.XXX.121"><tag><member>mm_loc_agencias</member></tag></entry></register></payload></uid-message>&type=user-id&target=FIREWALL_SERIAL_NUMBER -----------     DAG populated   Using the same user (login/password, not api key) in MM, I can't see new IPs populating my DAG. My indicator in the DAGPusher node is showed in the figure below.   Indicator in DAGPusher I am using the tag prefix "mm_" in DAGPusher and the miner attachs the tag "loc_agencias" to the indicator. My DAG is prepared to match "mm_loc_agencias".   Can you visualize any error in the precedures/parameters I am following/setting in my configuration.   Best regards. ... View more

Hi @xhoms   No, I'm not targeting Panorama. I created the shared DAG in Panorama, but I'm pushing the IP to a specific Firewall. I used the command below (from the MM machine) to generate the key (for both users).   ----------------- curl -k -X GET 'https://firewall/api/?type=keygen&user=user&password=xxxxxxx' ----------------   After your comment, I check out if Panorama would generate a different api key (for both users), so I repeated the proccess.   ----------------- curl -k -X GET 'https://panorama/api/?type=keygen&user=user&password=xxxxxxx' ----------------   I got the same keys. So the keys are double checked. ... View more

Hi @xhoms   I think I have to backtrack when I said I had the correct credentials. At first, I used a key generated for a active "super user" because I was just testing DAGPusher and didn't want to create a new user. Everything I reported in previous posts were related with this user. To eliminate any doubt I tried to push the IP to Firewall by myself using the line below:   -------------- curl -F key=LUFRPT0-----------kJQbm9qTT0 --form file=@/home/user/ips.xml "https://firewall/api/?type=user-id" --------------   But I got this answer:   -------------- <response status = 'error' code = '403'><result><msg>Invalid credentials.</msg></result></response> --------------   So I created a new user (now, not a "super user", but a "panorama administrator" (PANORAMA) and "device administrator" (FIREWALL)) and submit the previous line with the new key:   -------------- curl -F key=LUFRPT1-----------sc21JVT0 --form file=@/home/user/ips.xml "https://firewall/api/?type=user-id" --------------   and I got the same answer:   -------------- <response status = 'error' code = '403'><result><msg>Invalid credentials.</msg></result></response> --------------   Both usear are capable of create DAG, adresses (Objects) etc. and commit these changes. Does it make any sense?  ... View more

Hi @xhoms   This customization that you said (dealing with a VSYS), is something similar the hacking we apply when using an api key (DAGPusher file configuration)? The same way you mentioned in the "Using MineMeld to implement a poor man's NAC application (DAGPusher)" article? I couldn't find any information.     ... View more

Hi @xhoms   I double checked the credentials and I can confirm that the user used to push the IPs to the DAG has the correct permissions. Could you tell me wich specific procedures should I follow in case I have a VSYS ( only one, named vsys1, with default configurations)?   Thank you again. Best regards. ... View more

Hi @xhoms   thank you for your reply. Almost sure the credential used has the privilege to access the API. I will double check it as soon as possible. To be frank, I am most concerned with the sintaxe and tags used in the Miner and DAGPusher.   Can you confirm that the way I explicity the "tag" (at least one of the three ways I've tried out) atribute in my Miner is correct? Will it, togheter with the "tag_prefix" (mm_) in DAGPusher, match the 'mm_loc_agencias' criteria that I put in the shared DAG? I'm not sure.   Can you confirm that is possible to populate a shared DAG (created in Panorama) just in one Firewall?   Thank you again Best regards ... View more

Hi @lmori , @xhoms   Could you help me with this issue. I believe the problem is in my local miner, specifically the way the "tag" is attached to the indicator.   My shared DAG in Panorama is prepared to match 'mm_loc_agencias'.   My local DAGPusher has, now, this configuration:   ============== {     "tag_prefix": "mm_",     "tag_watermark": "pushed",     "tag_attributes": "loc" } ==============   My local miner is from the class "minemeld.ft.http.HttpFT". I've tried out three configurations so far and none of them successfully. The basic configuration is:   ============== age_out:     default: null     sudden_death: true attributes:     confidence: 95     share_level: green     type: IPv4     interval: 300     tag: indicator:     regex: ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})     transform: \1 verify_cert: false source_name: xxx_log url: http://xxx/static/log.txt ================   In tag I've tried:   ================       tag:         "loc": "agencias"   ------       tag:         loc: "agencias"   -------       tag: agencias   ================   I would really appreciate any help. I've read the "Poor man's NAC Application" article, but there, you use a localDB node to feed the DAGPusher. In my case I use a local miner, and the way the attributes are attached to indicator are different.   Thank you in advanced. Best regards.   ... View more

Hi guys,   I would like to share some information and ask one more question. In the figure attached, you can see that my MM is pushing data to the Firewall (traffic log). My question is: EDLs have a specific interface to be received (DEVICE -> SERVICES -> SERVICES ROUTE CONFIGURATION). How about DAGs? Do the API in DAGpusher have to send the data to a specific interface?   Best regards. ... View more

Hi @xhoms,   I think I was right. The problem seems to be with the certificate. Look what I get (figure) running the shell command curl <URL>. My machine doesn't belive in the certificate chain. Is it?   Best regards.   ... View more

Hi @xhoms   I created a new prototype based in the regex you sent, but I got the same behaviour. I'm adding a figure with the  extract of the log related with this node specifically. Do you see anything relevant? I don't. May be certificate in the URL mined?   Best regards. ... View more