About benlewis

benlewis · ‎05-04-2022

Hey @Jon_Woloshyn, thanks for letting me know that it helped you out.

benlewis · ‎04-19-2022

After building a VM based lab and recreating the process I have discovered the root cause. Panorama 10.1.3+ has a new feature to support unique Master Keys for firewalls, Panorama, Log Collectors etc and during device config import into Panorama there is a field to enter a Master Key. This field is not documented in the 10.1 Panorama administrator guide at time of writing this. As a Master Key was never set I naturally left this field blank during the import which was the cause as Panorama no longer uses the well known default Master Key and therefore when pushing back to the firewall, passwords and pre-shared keys won't match. The fix is to enter the well known default Master Key when importing device config from firewalls where a Master Key has never been set. This ensures password and pre-shared key encryption strings are identical when pushing config back to the firewalls during the 'transition to Panorama' process. Hope this helps someone else!

benlewis · ‎04-19-2022

I had an issue recently when attempting to migrate a 3250 HA pair (10.0.8-h4) to Panorama 10.1.3. I was able to complete the push and commit however anything that uses a password or secret such as a IKE Gateway pre-shared key didn't work. The resultant outage was significant with over 100 IPSec VPN's configured so I quickly reverted the 3250's to their original device state. I suspected someone had set a new Master Key however that wasn't the case. I then compared the encrypted values for passwords and pre-shared keys between firewalls and Panorama and they were indeed different. I know Panorama 10.1.3 doesn't support firewalls running 10.1.0 - 10.1.2 (Panorama Admin Guide) however I can't find official word that 10.0.X isn't supported either. Downgrading isn't really an option as 10.0 becomes end of life in July this year so next step is trying the process again with an eval VM running 10.0.8-h4 loaded with very similar config to the 3250's and see if the same result occurs. Following on from that I will upgrade Panorama and the VM to 10.1.5-h1 to see if the issue is resolved. I have another 15 x 440's on Satellite links to migrate so need to make sure the process is error free.

benlewis · ‎04-13-2022

Hi @zinkt101 , I had a similar issue recently when attempting to migrate a 3250 HA pair (10.0.8-h4) to Panorama 10.1.3. I was able to complete the push and commit however anything that uses a password or secret such as a IKE Gateway pre-shared key didn't work. The resultant outage was significant with over 100 IPSec VPN's configured so I quickly reverted the 3250's to their original device state. I suspected someone had set a new Master Key however that wasn't the case. I then compared the encrypted values for passwords and pre-shared keys between firewalls and Panorama and they were indeed different. I know Panorama 10.1.3 doesn't support firewalls running 10.1.0 - 10.1.2 (Panorama Admin Guide) however I can't find official word that 10.0.X isn't supported either. Downgrading isn't really an option as 10.0 becomes end of life in July this year so next step is trying the process again with an eval VM running 10.0.8-h4 loaded with very similar config to the 3250's and see if the same result occurs. Following on from that I will upgrade Panorama and the VM to 10.1.5-h1 to see if the issue is resolved. I have another 15 x 440's on Satellite links to migrate so need to make sure the process is error free.

benlewis · ‎03-27-2022

When trying to migrate a HA pair of PA 3250's into Panorama 10.1, address objects used for BGP Remote Peers aren't supported. Objects were imported to Panorama Shared location using Device import process. Address Objects either in a specific Device Group or the Shared location are not listed when trying to configure a BGP Peer. Images included below of Objects in Shared location and BGP Remote Peer drop down where no address objects are available. Anyone seen this issue previously? Curiously, Address Objects in Shared location are supported for Interface IP addresses. Is it a known caveat?

benlewis · ‎03-22-2022

I'm going through this now and having trouble with the MCAS/MDCA Log Collector Container parsing the logs forwarded from Panorama 9.1 as it won't send to cloud. I'm working with Microsoft Support however they haven't been able offer any assistance apart from pointing out Panorama is sending it's hostname in Syslog which isn't supported in the 'PA Series Firewall' Data Source format. Unfortunately disabling this setting isn't an option as it's used for an existing SIEM integration. The 'PA Series Firewall LEEF' Data Source format sample does show the Syslog sender hostname so i've changed to LEEF however still not working. I'll update if I get resolution on this.

benlewis · ‎08-09-2020

Hi Azuniga, If you do try and replicate, please note the export is from a Multi-Domain Management and VSX Gateway deployment. I am specifying the correct Domain (-d) and Package (-k) parameters during export so these virtualization mechanisms shouldn't be relevant however I thought it would best for completeness. Thanks Ben

benlewis · ‎08-08-2020

Hi Azuniga, Unfortunately upgrading to 1.1.76.1 has not resolved the issue. Any assistance would be greatly appreciated. Thanks Ben

benlewis · ‎08-06-2020

Thanks Azuniga, I will arrange for the customer to upgrade Expedition and let you know how it goes.

benlewis · ‎08-05-2020

Currently working on migration from CP R80.20 to PA 9.0.X. and having issues with auto-zoning during the import process using the show policy package java app method. Only the Application Layer section of the Security policy has auto-zoning applied. The Network Layer has no Zones applied. Interfaces and Zones are created correctly from netstat output however they only appear in the Application Layer Template which is why no Zones are applied to the Network Layer Security policy. Expedition version is 1.1.69.3. The older API method works when only exporting the Network Layer however in the newer version there is no java app parameter that allows excluding the Application Layer. Sadly I need to use the latest version for this Customer's migration. Thanks Ben

benlewis · ‎04-19-2020

Hi @MP18, I'm trying to understand the best option when putting 2 x PA NGFW's in Active/Passive, each with Vwire's between a Check Point 2-Node Active/Passive Cluster and 2 x L3 Switches. My specific concern was how the Active PA NGFW would follow the Active Check Point Cluster Node in a fail-over event. My concern quickly switched however when VSLS was enabled to make the Check Point Cluster Active/Active. Now I am trying to understand the implications of PA Active/Active Vwire's in a failure scenario. My backup plan is no HA with TCP syn check disabled and to be honest will most likely be the chosen option as we're in emergency response mode for this work. Thanks Ben

benlewis · ‎04-08-2020

Hi @MP18, Would mind elaborating how you are running active/active in vwire mode? I am looking at how to use vwire behind a Check Point Cluster as an interim measure until the Palo's replace the Check Points. Thanks Ben

benlewis · ‎04-01-2020

Thanks @dgildelaig, appreciate the response. Output to CSV is helpful but was hoping to output as ASA config. It would be great if we could convince every Customer to migrate to Palo 😉

benlewis · ‎03-31-2020

Hi All, Hoping to use Expedition to clean up an ASA config without migrating to Palo. Understand it's not the intended purpose but wondering if the imported ASA config can be cleaned up and extracted somehow, perhaps as a raw file? I can see Project Snapshots are stored as .sql files under /home/userSpace/Projects/<project-name>/Backups. Have used Expedition many times for migrations to Palo and it would be great to have this ability for Customers who are thinking about migrating. Thanks

Member Since	‎01-24-2019 08:06 PM
Date Last Visited	‎06-02-2022 03:07 AM
Posts	14
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎06-02-2022 03:07 AM

About benlewis

Re: Failed migration to Panorama 10.1.3

Re: Failed migration to Panorama 10.1.3

Failed migration to Panorama 10.1.3

Re: Fail to migrate Palo HA FW to Panorama Mgmt

Panorama Template Address Object Caveat

Re: Failed migration to Panorama 10.1.3

Firewall Policy cleanup and export

Re: Failed migration to Panorama 10.1.3

Re: Failed migration to Panorama 10.1.3

Failed migration to Panorama 10.1.3

Re: Fail to migrate Palo HA FW to Panorama Mgmt

Panorama Template Address Object Caveat

Re: Setting up syslog forwarding from Panorama to Microsoft Cloud app security

Re: Check Point R80+ policy auto-zoning on import partially works

Re: Check Point R80+ policy auto-zoning on import partially works

Re: Check Point R80+ policy auto-zoning on import partially works

Check Point R80+ policy auto-zoning on import partially works

Re: Active/Passive vs. Active/Active

Re: Active/Passive vs. Active/Active

Re: Firewall Policy cleanup and export

Firewall Policy cleanup and export