This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About bartpmika
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About bartpmika
09-05-2023
8Posts
7Likes
1Solution
Sep 05, 2023Last Visited
User
Activity
User
Profile
Latest posts by bartpmika
| Subject | Views | Posted |
|---|---|---|
| 353 | 09-05-2023 04:54 PM | |
| 2771 | 06-30-2022 10:29 AM | |
| 2358 | 06-26-2019 05:05 PM | |
| 2458 | 06-26-2019 05:00 PM | |
| 3477 | 06-24-2019 11:14 AM | |
| 3541 | 06-18-2019 08:04 PM | |
| 3564 | 06-18-2019 11:52 AM | |
| 3574 | 06-18-2019 11:14 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 4 Likes | 09-05-2023 04:54 PM | |
| 3 Likes | 06-30-2022 10:29 AM |
User Badges
Community Statistics
| Member Since | 06-14-2019 09:10 AM |
| Date Last Visited | 09-05-2023 09:37 PM |
| Posts | 8 |
| Total Likes Received | 7 |
09-05-2023
04:54 PM
4 Kudos
Here is the actual solution to PCAP the decrypted traffic
you have to install the free decryption port mirror license
configure the decryption mirror port
configure the decryption profile to mirror to the decrypt port
attach the decryption profile to the decryption rule
don't forget to commit 😉
Most of the steps above are covered here: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/decryption/configure-decryption-port-mirroring
Then you can PCAP the decryption mirror port, and you will get decrypted data. It doesn't actually have to be plugged into anything, just configured.
... View more
06-30-2022
10:29 AM
3 Kudos
you can enable capturing the GENEVE encapsulated traffic by running the following command in CLI: debug dataplane packet-diag set capture encapsulation yes
... View more
06-26-2019
05:05 PM
just to add, thats only if I select my Panorama device for "Import Applications, url-categories and Regions from Device:"
i jsut tried leaving the "default" value and I didn't get the error
... View more
06-26-2019
05:00 PM
I am getting a "Remote Exception" mesage when trying to create a project. I am running Expedition 1.1.25. Just updated it to this version, still getting the error though.
Can anyone help?
... View more
06-24-2019
11:14 AM
to clarify, the command to set expedition as the owner is:
sudo chown -R expedition.www-data logs
😉
... View more
06-18-2019
08:04 PM
thanks sjanita,
turns out the folder ownership has to be set to expedition. After I used the command below it stopped giving me this error
sudo chown -R www-data:www-data /hdd
That said, I have more problems now. It doesn't give me the error, but it also doesn't show me the csv files located there. I also tried to change a location of the parquet file store (settings>m.learning). It won't save any changes I make to this location. Somethign had to break after one of the updates.
I will just blast the VM and start over.
... View more
06-18-2019
11:52 AM
Actually, it looks like my problem goes even deeper. I moved the log files to sda. I no longer get an error, but it still doesn't display the logs.
... View more
06-18-2019
11:14 AM
I am trying to import logs exported from the firewalls to a mounted secondary drive. Expedition says it cannot access that location. I tried multiple permission combinations. Permissions are the same as in the locations that it can access ok. The file system is the same too. It can access this directory, untill I mount the external drive to it. Than it fails again.
To set up the secondary drive I followed the steps from the link below. One difference is that it didn't create sdb1, and mounts sdb itself, other than that everythign is like in that PDF, and the mounted drive works, the logs get exported to it.
Does anyone have any ideas how to get it to work?
https://live.paloaltonetworks.com/t5/Expedition-Discussions/How-to-expand-storage-by-adding-a-second-drive-to-Expedition/td-p/252327?attachment-id=7817
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-05-2023
09:37 PM
|
Latest Tags
No tags yet
Likes From
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks