About alestevez

alestevez · ‎11-11-2019

Expedition 1.1.47 - Dynamic Log Connectors and Devices Monitor Overview The Expedition Team has been working very hard to bring these new functionalities to the community. In the spirit of continuously improving and enhancing Expedition capabilities, we added two new functions to help our customers speed up App-ID adoption function and get better visibility on the PAN-OS device state. For more information on the new features for Expedition, please review the attached document below.

alestevez · ‎10-10-2019

Hi, If you are trying to migrate from Checkpoint R80.XXX and you see Expedition is missing some address groups members its usually because the checkpoint exporter script is not working properly and it's failing to add all the member definitions. Seems there is a problem to grab all the nested objects so to succeed with your migration we have to update that script to the latest version. Please follow the instructions here to download the latest version, upload it to your Management Server and run it from there. https://github.com/CheckPointSW/ShowPolicyPackage

alestevez · ‎10-03-2019

Hi, yes we are here. Are you in 1.1.38? is still there the problem? if yes, please send us an email to fwmigrate at paloaltonetworks dot com and we can schedule a zoom session to see what's going on!

alestevez · ‎09-17-2019

Hi, We have found our script was not correctly working when the VM was spinned in the cloud. So we updated the script to correctly install Expedition when you run the VM in google or Amazon Cloud (any cloud) Try the process again: wget https://conversionupdates.paloaltonetworks.com/expeditionInstaller.tgz tar xvzf expeditionInstaller.tgz chmod +x initSetup.sh sudo ./initSetup.sh

alestevez · ‎04-10-2019

Only the Checks with the Dark Gray bag can be remediated by selecting them and clicking the Remediate button from the bottom bar. Only checks under Device Config can be remediated.

alestevez · ‎04-03-2019

you are right, you could cut the policy from shared and paste into the rulebase under vsys1 and that's it 🙂 Only check to do if there is a rulename duplicated after the paste 🙂

alestevez · ‎03-29-2019

Hi, you are right. In Expedition and for backward compatibility between version we were using the old API calls under the path: /esp/restapi.esp In Panos 9.0 this way to call the API has been deprecated so now we are updating Expedition to use the current API Path /api Next version 1.1.12 will come with the hotfix.

alestevez · ‎03-29-2019

As you already know, Expedition was conceived to reduce the time and efforts a security admin needs to improve and optimize their Palo Alto Networks configurations. Following that effort, we have added, within Expedition, support not only to run a BPA analysis if not also be able to remediate some of the failed checks (all related to Device Config) and now integration with the project IronSkillet. https://github.com/PaloAltoNetworks/iron-skillet IronSkillet is basically a template that provides several best practices to minize the time to deploy a Day 1 Configuration in your Palo Alto Networks devices. With this article, we show you how to create a new Base Configuration file plus remediate some of the checks failed at the time to run the BPA and export that configuration to your device. With this example, you will get a config that is 67% following the BPA recomendations.

alestevez · ‎01-30-2019

@nburrows It should work, probably they didnt change the config. If you can please verify it. Thanks

alestevez · ‎01-14-2019

Hi, I will recommend close this threat here and re open it under the Firewall Community, This is for Expedition and it doesnt capture the attention of everybody 🙂

alestevez · ‎01-09-2019

I just tried to run the 2 commands from the hardening guide and worked for me, Have you tried to use another browser to see if it gets the new certificate? You can check in the config file if your apache is pointing to those certificates? go to /etc/apache/sites-enabled and edit the file "default-ssl.conf and check for SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key Regards

alestevez · ‎01-09-2019

Probably you did but Have you restarted the apache daemon after the changes?

alestevez · ‎01-08-2019

If the Firepower config has the access-lists like this will work access-list myaccesslist advaced xxxx x xx x x x

alestevez · ‎12-22-2018

Hi, not true at all 🙂 That means only the Release file was not found (in purpose) but if now you continue with the next command sudo apt-get install expedition-beta You will see how upgrades, please let us know

alestevez · ‎12-12-2018

Hi, End of this week we will release Expedition 1.1 with IronSkillet integrated.

alestevez · ‎12-12-2018

Try to create a new repo under cd /etc/apt/sources.list.d/ sudo vi ex-repo.list deb https://conversionupdates.paloaltonetworks.com/ expedition-updates/ Then try sudo apt-get update sudo apt-get install expedition-beta But maybe some packages are required but not installed as depencies.... You have an OVA in the live community to download and go from there too....

alestevez · ‎12-12-2018

Probably is Checkpoint API problem, try to reduce to 100 instead of 400 and see...

alestevez · ‎12-04-2018

something is breaking the generation of the xml so we need to see the output from the command sudo tail -100 /tmp/error

alestevez · ‎11-29-2018

That is a nice Feature Request by the way, We will implementing it soon. Thanks (You cannot import a device config manually today for ML sorry)

alestevez · ‎11-29-2018

Remember to run this command: sudo bash /var/www/html/OS/BPA/updateBPA306.sh This command appears when you are updating Expedition and it will install python3 and reinstall the BPA. After that you should see the version from the Dashboard !

alestevez · ‎11-27-2018

We are gonna check that. thanks for let us know....

alestevez · ‎11-27-2018

Are you sure you didnt UPGRADE the OS? It should stay in 16.04 not 18.04... The system upgrade will break Expedition....

alestevez · ‎11-27-2018

Hi Bruno, Common Apps are taken in that way, apps like ping, dns that generates tons of logs are considered by ML as a single rule allowed from any to any. If you want to know the sources and destinations then you can apply Rule Enrichment. We do that because those apps can represent the 60% of the total traffic and at the time to analyze you can exclude them if you want meaning we will only consider the 40% of the traffic just for the analisys.

alestevez · ‎11-27-2018

Is the Task Manager UP ??

alestevez · ‎11-27-2018

Hi its the first time ever we heard something like that sorry 😞

alestevez · ‎11-26-2018

Maybe did you UPGRADE the OS? with something like "apt-get updagre" ? If yes you should downgrade it or download it again and dont use the Upgrade or dist-upgrade commands, just use sudo apt-get update sudo apt-get install expedition-beta There is something in newer version of the packages in the new OS version that breaks expedition so keep it in 16.04 dont upgrade to 18.04

alestevez · ‎11-19-2018

Have you send the Interfaces first?

alestevez · ‎11-13-2018

If you removed there is no way to bing it back sorry

alestevez · ‎11-13-2018

If you go to policies and change the DG from "all" to the one you want to work then come back to the Dashboard to see the statistics related to that DG only...

alestevez · ‎11-13-2018

Hi, remember to sanityze the XML file and be sure the very first line is <configuration> and the latest is </configuration> To validate the config is valid please try to open it with Firefox, if you get an error please go to the referenced line and fix de code to make a valid XML

Date Registered	‎03-22-2011 08:43 AM
Date Last Visited	Wednesday
Total Messages Posted	918
Total Likes Received	202

Online Status	Offline
Date Last Visited	Wednesday

Enterprise

Prisma

Cortex

About alestevez