About Duplem

Hello all I just discovered expedition, what a great tool ! Just got a problem using it with Checkpoint R80 and trying to retrieve a whole configuration. It seems like I get policies and nat rules as expected, but not all the objects.   How did you do the job on your side ?   Details on my experience below :   As an example, I imported a rule containing an object group named MY_GROUP, containing MEMBER1 to MEMBER8. All objects are present in the export as uid. I can see that in Expedition, I only got one member. Digging in the json file, I can see that the member I got is the one provided in the object dictionnary. I tested for this group to get the whole group config using "mgmt_cli show group name MY_GROUP details-level full --format json" and to import it in the initial file. It worked. So Checkpoint did not provide the whole dictionnary using my commands.   mgmt_cli show access-rulebase offset 0 limit 800 name "CheckPoint_GS Security" details-level "full" use-object-dictionary true --format json mgmt_cli show nat-rulebase offset 0 limit 800 package "CheckPoint_GS" details-level "full" use-object-dictionary true --format json   Any idea could help, thanks in advance 🙂 ... View more

Hello,   We have the same problem on a PA5060 using 6.1.10 PANOS. Here here the result of the show management-clients command.   ################ (active)> show management-clients Client PRI State Progress ------------------------------------------------------------------------- routed 30 P2-ok 100 ha_agent 25 P2-ok 100 device 20 init 0 ikemgr 10 P2-ok 100 keymgr 10 init 0 (op cmds only) logrcvr 10 P2-ok 100 dhcpd 10 P2-ok 100 varrcvr 10 P2-ok 100 l3svc 10 P2-ok 100 sslvpn 10 P2-ok 100 rasmgr 10 P2-ok 100 useridd 10 P2-ok 100 satd 10 P2-ok 100 websrvr 10 P2-ok 100 sslmgr 10 P2-ok 100 authd 10 P2-ok 100 pppoed 10 P2-ok 100 dnsproxyd 10 P2-ok 100 cryptod 10 P2-ok 100 dagger 10 init 0 (op cmds only) l2ctrld 10 P2-ok 100   Overall status: init. Progress: 0 Warnings: Errors: ##########     Did you find a way to resolve the problem ? Any idea from others ?   Best regards, /edu ... View more

Hi Pankaj,   I checked your link and cannot get the information I need. The link is great for capacity planning or monitoring, but not to design a solution.   Rule Used Available -------------------------------- ---------- ---------- NAT 0 516096   So this rule could use 516096MB of memory, fine... but what is the  memory usage of a NAT 64 session ?  That's why I talked about table size and not memory pool.   Your answer is a brick on the wall, but I need the second part now 🙂 Or only an answer about the  theorical maximum number of simultaneous NAT64 sessions running over a PA5060.   Don't hesitate to explain your answer if I misunderstood.   Best Regards,   Emmanuel ... View more

Hello,   Thank you for your interet on my post. However I can't find the answer with your command, because I'm looking for a system table maximum size and not for a policy number information :   xxxx(active)> show system state | match nat cfg.general.max-di-nat-policy-rule: 8000 cfg.general.max-dip-nat-policy-rule: 450 cfg.general.max-nat-policy-rule: 8000 cfg.general.max-si-nat-policy-rule: 8000 cfg.general.max-signature: 6000 cfg.general.max-threat-signature: 3000 <output suppressed> cfg.nat.max-range-per-ip: 8 peer.cfg.general.max-di-nat-policy-rule: 8000 peer.cfg.general.max-dip-nat-policy-rule: 450 peer.cfg.general.max-nat-policy-rule: 8000 peer.cfg.general.max-si-nat-policy-rule: 8000 peer.cfg.general.max-signature: 6000 peer.cfg.general.max-threat-signature: 3000 <output suppressed> peer.cfg.nat.max-range-per-ip: 8 peer.sw.mprelay.s1.cp.nat_rpt: 0x0 peer.sw.mprelay.s1.dp0.nat_rpt: 0x1 peer.sw.mprelay.s1.dp1.nat_rpt: 0x1 peer.sw.mprelay.s1.dp2.nat_rpt: 0x1 sw.mprelay.s1.cp.nat_rpt: 0x0 sw.mprelay.s1.dp0.nat_rpt: 0x1 sw.mprelay.s1.dp1.nat_rpt: 0x1 sw.mprelay.s1.dp2.nat_rpt: 0x1   Could anybody help ?   Best Regards   Emmanuel ... View more

It seems you didn't understood the problem. Better say me that if I don't want skype on my network, skype should not be installed on computers... Easy to say, no  ? In addition, you didn't answer all questions : Where could I get information about drop-reset implementation on apps ? Could this information be added on applipedia ? Last but not least, we need to be able to choose the type of deny action, but this is another topic. ... View more

Thank you for this answer. This is a problem because Skype opens many TCP connections which then remain in the INIT state. As MS Windows allows only limited number of simultaneous connections, all other connection attempts are slowed and users are complaining. Please could you confirm that the deny action is a drop and not a drop-reset ? In this case we will need to find a workaround, and this will generate delay and additional cost for us. As already said by many users, we would appreciate to have the opportunity to choose the action by ourselves ! Best Regards ... View more

Hello, We would like to block screen and file sharing. We are running PANOS 4.0.8. Could you please share any news about this type of filtering ? ED ... View more

Hi, We are still in 4.0.4 for now. I just looked further and had an idea. And if this "all" were an object ? And it was. So the guy who configured this firewall created an object named all and did not use the "any" checkbox everywhere. You will have an example in attached jpg file. Forget this question, it is our configuration specific. Sorry for the mistake, and thank you for this answer you helped me to get explanation. ... View more