About BOkay

Is there a way to forward logs from individual rules by adding Expedition to their Log Forwarding Profile rather than setting up a Scheduled Log Export which forwards an entire firewall's logs?   Reason I ask is I need to use MI to analyze traffic for some specific rules but do not need to analyze traffic on an entire firewall. I have Scheduled Log Export setup for some smaller firewalls where the entire policy needs to be analyzed and this works well.  But, I also have some very large high traffic firewalls where I need to analyze only a few rules and scheduling the export of their entire traffic log would just be too much for our Expedition server.     Any thoughts?  Thank you! ... View more

I'm having an issue trying to filter my objects list on one of my panoramas to show only the unused objects.   Here are the steps I'm following: If I create a brand new project you can see that my Unused objects are a fraction of the total object count. When the issue I'm experiencing occurs one of the issues it causes is that the project will start to report all objects are unused. Now when I try to filter unused objects I've tried multiple different criteria.  Just Address, or just Shared vsys, or any other combination I've tried with the same results.  In this example I'm using the following parameters. When I apply the filter I get the please wait progress bar.  The eventually an error. While this is filter is processing and after the error the mysql process on the server stays at 100% CPU (This is an 8 CPU server)   Now on a side note, on a different Panorama we have that has a slightly smaller rule base, I have let this sit for over an hour, then rebooted the server and it has been hit or miss in getting the correct results. But on this server it is 100% not getting the results.   After an hour and a half the mysql process has subsided.   When I return to Expedition I get this error when trying to navigate. I try to restart services and I get this error. I reboot the server and log back in to Expedition I see that now all objects are considered unused. And when I go into the objects the filter has still not applied.     I've tried several times, with brand new projects, and different combination of filters looking for unused objects and the outcome is the same each time. I had the same issue on a different Panorama and it took several attempts before I got it to work, and that seemed to be luck with how long I waited for the process to run and rebooting the service or server.   Also a thing to note on the panorama that this did worked on was that it didn't matter if I specified only "address", "address-group", "service", "service-group", "tag", or any combination of them for the unused filter, the results would always filter all of the type of objects even if I specified just one.   Just a guess on my part but I think on the back end there may be a flaw in the query that is being run against the mysql database as well as some additional indexing that may need to be added.   Other than that, are there any thoughts on how I can go about getting the results I'm looking for of showing only unused objects?           ... View more

I've successfully setup Expedition to consume logs and provide M. Learning traffic analysis for any any rules. I've done 6 any any rules so far and all but one look correct.   The following any any rule has a source zone of Trans100_inside and destination zone of Trans100_outside. Yet, the traffic analysis shows traffic going both ways which shouldn't be possible since it would violate this rule.   Any thoughts on the issue here? ... View more