About ScottHammond

ScottHammond · ‎08-04-2020

Two aws Pano's in Panorama mode. Primary(active) Panorama doesn't see the collector that is the Secondary/Passive Panorama as being available to add to the collector group. Drop down is blank. Walk through the same steps on the Secondary/Passive node and it sees its local disk as available to add. Which of course you cant because its the passive node. All ports related to logging have been opened up per the AWS network team. What else can I check?

ScottHammond · ‎05-22-2020

So the fix was that I needed to expand the element to include not only the member but the "from" after that. Poof!

ScottHammond · ‎05-12-2020

Okay so that didnt look right and I changed it to /from/member&element=<member>gp_vpn_general</member> resulting in < response status = "error" code = "12"> < msg > < line > <![CDATA[ needs to have non NULL value]]> </ line > </ msg > </ response >

ScottHammond · ‎05-12-2020

If I add zones from the cli with a debug running (clearing running a set command) the debug says <request cmd="set" obj="/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Location']/post-rulebase/security/rules/entry[@name='Name']/from" cookie="8038565277332854"><member>gp_vpn_general</member></request> So I changed my xpath to xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Location']/post-rulebase/security/rules/entry[@name='Name']/from/<member>gp_vpn_general</member> and Postman give me this error- < response status = "error" code = "13"> < msg > < line > Could not find schema node for xpath /config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Location']/post-rulebase/security/rules/entry[@name='Name']/from < member > gp_vpn_general </ member > </ line > </ msg > </ response > Could not find schema node for xpath

ScottHammond · ‎05-12-2020

Doing a POST If I run it again it replaces whatever is there one for one. THis is using the edit function. (set doesnt work because the rule already exists) I see there is a method to add multiple members to address groups via the API, and you would think it would be the same for zones...but no joy

ScottHammond · ‎05-12-2020

So I have been REPLACING tags and zones with the xml API with great success. What I have yet to do is figure out how to ADD tags or zones without disturbing the existing objects...or even replace them with multiple tags/zones Working replacement of a zone- xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name=' {{Location}} ']/post-rulebase/security/rules/entry[@name=' {{Name}} ']/from/member&element=<member>gp_vpn_general</member> This works to replace a single zone....fails if you run it against a rule with multiple zones. I've tried putting multiple members in the element but it only sees and inserts the first one xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name=' {{Location}} ']/post-rulebase/security/rules/entry[@name=' {{Name}} ']/from/member&element=<member>gp_vpn_general</member><member>pci</member> That puts the vpn zone in and ignores the pci zone, if I switch them it will put the pci zone in and ignore the vpn zone. So the function seems a 1 for 1 REPLACE Can anyone nudge me in the direction for making additions?

ScottHammond · ‎03-12-2020

AH HA! apparently you just add it with serial number and click OK. THEN commit THEN go back and add a disk You cant add the disk from the start unless you jump through the hoops. Something not mentioned in the documentation.. Lesson learned

ScottHammond · ‎03-12-2020

Hey folks- Ive got an HA pair of Pano's in AWS that I needed to do some local logging to due to some missing features in Cortex. Added the disks....changed the mode and poof! Nothing Im not seeing a default logging collector or collector group as the documentation indicates I should have. When I try to manually create the collectors there are no disks available event though the disk shows Admin enabled at the cli of Pano. Feels like I am missing some simple step that was assumed in the documentation. https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-appliance/set-up-the-panorama-virtual-appliance-with-local-log-collector

ScottHammond · ‎03-09-2020

yeah it doesn't work. Running it as root even....its some other password internal down in the weeds password. I tried every default. Neither here nor there, I gave up and rebuilt the projects from scratch. Wasn't all that far into them.

ScottHammond · ‎03-05-2020

Makes sense. Is there a particular argument for a password? root@Expedition:~# mysqldump --all-databases > dump.sql mysqldump: Got error: 1045: "Access denied for user 'root'@'localhost' (using password: NO)" when trying to connect

ScottHammond · ‎03-04-2020

So my expedition GUI died and I couldnt get it back. I copied the projects directory out and into the same directory on the new one. But the GUI isnt seeing the projects that were imported via cli. Is there hope?

Member Since	‎02-04-2020 07:29 AM
Date Last Visited	‎03-10-2021 03:03 PM
Posts	11
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎03-10-2021 03:03 PM

About ScottHammond

aws Panorama mode cant see the HA available to add to the log collector gr

Re: Adding Zones/Tags with XML API

Re: Adding Zones/Tags with XML API

Re: Adding Zones/Tags with XML API

Re: Adding Zones/Tags with XML API

Re: Panorama Mode - No default collector

aws Panorama mode cant see the HA available to add to the log collector gr

Re: Adding Zones/Tags with XML API

Re: Adding Zones/Tags with XML API

Re: Adding Zones/Tags with XML API

Re: Adding Zones/Tags with XML API

Adding Zones/Tags with XML API

Re: Panorama Mode - No default collector

Panorama Mode - No default collector

Re: Restoring projects from cli?

Re: Restoring projects from cli?

Restoring projects from cli?

Network Security

Cloud Security

Security Operations

About ScottHammond