About benlewis

benlewis · ‎08-09-2020

Hi Azuniga, If you do try and replicate, please note the export is from a Multi-Domain Management and VSX Gateway deployment. I am specifying the correct Domain (-d) and Package (-k) parameters during export so these virtualization mechanisms shouldn't be relevant however I thought it would best for completeness. Thanks Ben

benlewis · ‎08-08-2020

Hi Azuniga, Unfortunately upgrading to 1.1.76.1 has not resolved the issue. Any assistance would be greatly appreciated. Thanks Ben

benlewis · ‎08-06-2020

Thanks Azuniga, I will arrange for the customer to upgrade Expedition and let you know how it goes.

benlewis · ‎08-05-2020

Currently working on migration from CP R80.20 to PA 9.0.X. and having issues with auto-zoning during the import process using the show policy package java app method. Only the Application Layer section of the Security policy has auto-zoning applied. The Network Layer has no Zones applied. Interfaces and Zones are created correctly from netstat output however they only appear in the Application Layer Template which is why no Zones are applied to the Network Layer Security policy. Expedition version is 1.1.69.3. The older API method works when only exporting the Network Layer however in the newer version there is no java app parameter that allows excluding the Application Layer. Sadly I need to use the latest version for this Customer's migration. Thanks Ben

benlewis · ‎04-19-2020

Hi @MP18, I'm trying to understand the best option when putting 2 x PA NGFW's in Active/Passive, each with Vwire's between a Check Point 2-Node Active/Passive Cluster and 2 x L3 Switches. My specific concern was how the Active PA NGFW would follow the Active Check Point Cluster Node in a fail-over event. My concern quickly switched however when VSLS was enabled to make the Check Point Cluster Active/Active. Now I am trying to understand the implications of PA Active/Active Vwire's in a failure scenario. My backup plan is no HA with TCP syn check disabled and to be honest will most likely be the chosen option as we're in emergency response mode for this work. Thanks Ben

benlewis · ‎04-08-2020

Hi @MP18, Would mind elaborating how you are running active/active in vwire mode? I am looking at how to use vwire behind a Check Point Cluster as an interim measure until the Palo's replace the Check Points. Thanks Ben

benlewis · ‎04-01-2020

Thanks @dgildelaig, appreciate the response. Output to CSV is helpful but was hoping to output as ASA config. It would be great if we could convince every Customer to migrate to Palo 😉

benlewis · ‎03-31-2020

Hi All, Hoping to use Expedition to clean up an ASA config without migrating to Palo. Understand it's not the intended purpose but wondering if the imported ASA config can be cleaned up and extracted somehow, perhaps as a raw file? I can see Project Snapshots are stored as .sql files under /home/userSpace/Projects/<project-name>/Backups. Have used Expedition many times for migrations to Palo and it would be great to have this ability for Customers who are thinking about migrating. Thanks

Date Registered	‎01-24-2019 08:06 PM
Date Last Visited	2 weeks ago
Total Messages Posted	8
Total Likes Received	1

Online Status	Offline
Date Last Visited	2 weeks ago

About benlewis

Re: Check Point R80+ policy auto-zoning on import partially works

Re: Check Point R80+ policy auto-zoning on import partially works

Re: Check Point R80+ policy auto-zoning on import partially works

Check Point R80+ policy auto-zoning on import partially works

Re: Active/Passive vs. Active/Active

Firewall Policy cleanup and export

Re: Check Point R80+ policy auto-zoning on import partially works

Re: Check Point R80+ policy auto-zoning on import partially works

Re: Check Point R80+ policy auto-zoning on import partially works

Check Point R80+ policy auto-zoning on import partially works

Re: Active/Passive vs. Active/Active

Re: Active/Passive vs. Active/Active

Re: Firewall Policy cleanup and export

Firewall Policy cleanup and export

Strata

Prisma

Cortex

About benlewis