About azuniga

azuniga

I would recommend opening a TAC case to see if you can identify why you are receiving this error. There can be different reasons why this error is present, I know in the past even when creating config changes within the firewall itself I received these every once in a while and TAC helped me identify why. I know this happened when you uploaded a XML configuration but with no error output it is really hard for us to identify what portion of the config is the problem or if there is an issue with the firewall processing this request. Palo Alto Networks TAC should be more helpful with your problem.

azuniga

We are looking into the issue and have a ticket internally.

azuniga

Hello, Can you please send a mail to fwmigrate@paloaltonetworks.com so we can work with you further on this issue.

azuniga

Hello lscott, This is the Expedition tool forum so this might not be the best place to ask this question. This might be a better place to ask that question. https://live.paloaltonetworks.com/t5/discussions/bd-p/fw_migrate_discuss However in my experience it really depends on your environment and overall architecture and how you would want to drive scalability within your network. Both BGP and OSPF can use prefix-lists route-maps and "route commands". I feel it would be very hard to answer your question without being able to look at your current architecture and 5 year growth plan but maybe you can post the question in the forum listed above and receive a better answer.

azuniga

Please go ahead and email us at fwmigrate@paloaltonetworks.com we can go ahead and set a session up to help you with this install.

azuniga

Please run the following commands. sudo apt-get update sudo apt-get install expedition-beta sudo bash /var/www/html/OS/BPA/updateBPA306.sh If you still have issues after running those commands please let me know. Thanks

azuniga · ‎05-05-2020

Hello, As Didac stated the more 'system:running config' will display the IPSEC encrypted keys into clear text so that you are able to migrate those tunnels over from the ASA. If you simply use a "show run" those keys remain encrypted and will not properly migrate over. Expedition is not able to crack the md5 hash for these keys so you will need to make it viewable for our tool to build these tunnels. So if possible display the keys in clear text and transfer them to your "show run" file save it and upload it into expedition to help migrate everything over in one file. I hope this answers your question.

azuniga · ‎05-05-2020

Hello, The problem with OSPF will be the amount of SPF recalculations that could happen with 100 end points should they flap. You would need to adjust the recalculations and it might not be worth it. When you say BGP with BFD I assume you are saying IBGP, and that depends on your redundancy setup at your spoke sites but it could be a good HA setup for fast recovery. Generally a good setup is a mix of eBGP and iBGP with BFD. As Didac has mentioned this forum is more related to expedition. For more information or network design I would recommend Orhan Ergun’s book on the CCDE, it has lots of great information. Good luck with your deployment!

azuniga · ‎04-30-2020

Hello, This looks like it is more of a ubuntu problem. https://askubuntu.com/questions/776721/problem-with-sudo-apt-get-update-the-repository-cdrom-does-not-have-a-releas

azuniga · ‎04-23-2020

It is working fine for me. I am using expedition version 1.1.66.2. What version are you on? Also try changing the bottom right part to select vsys1 if the rules reside within that vsys and attempt to do an export, I tried both ways and didn't see a difference on my end.

azuniga · ‎04-22-2020

Hello, Please perform the following commands to resolve it, this will require you to make some edits from within the CLI. sudo vi /etc/mysql/my.cnf file: bind-address = 127.0.0.1 That line should be commented out instead, like this: #bind-address = 127.0.0.1 I believe once you comment out the entry it should resolve your problem.

azuniga · ‎04-22-2020

Hello, I am using the same version of expedition and I am not having any issues. When you go to the dashboard it shows that you are migrating security rules, etc correct? I assume if you have nothing to export then it will come up as empty.

azuniga · ‎04-22-2020

Hello, Since you are doing a ASA > Palo Alto firewall migration this playlist should help you out. https://www.youtube.com/playlist?list=PLD6FJ8WNiIqVez8EBeoyRsnQcKTA5FuZ-

azuniga · ‎04-19-2020

That means there is an update process for expedition and those are the commands to update the required packages. Do not use the upgrade command, as it would also update some required packages that may break dependencies.

azuniga · ‎04-17-2020

No you shouldn't run into issues if there is some type of overlap between the firewall and panorama when you "merge" the configs those might become ghost objects. I believe when you have Panorama you would like that be become the overall management of your firewall in all aspects so the goal is always to push everything from Panorama and what isn't being pushed by Panorama you would want to migrate those firewall configs into Panorama to accomplish this. More information on ghost objects in this post and how to manage them. https://live.paloaltonetworks.com/t5/Expedition-Articles/What-Are-Ghost-Objects-and-How-To-Manage-Them/ta-p/273582

azuniga · ‎04-17-2020

Hello, I think this is the answer to your question. If you are having your Panorama manage your firewalls through templates then your firewall has almost no configuration within it. So if you import that firewall configuration into expedition you will see little to nothing since most of the policy management and updates are coming from Panorama. You will need to look at your firewall and what configuration it actually has in it versus what Panorama has and pushes to that firewall. So if you do that and realize that Panorama has all of the configuration information then you can work with that. I hope that explanation was able to answer your question.

azuniga · ‎04-17-2020

Hello, The checkpoint blades should only affect the interface portion of the migration, all of the other configuration portions should be able to move in without an issue. You will need to address this once you migrate in the configuration and remap the network interfaces. Although I do not have any videos for checkpoint but once you migrate the configuration most of the steps in the ASA video are the same. Cisco ASA migration video https://www.youtube.com/playlist?list=PLD6FJ8WNiIqVez8EBeoyRsnQcKTA5FuZ- I hope that's helpful.

azuniga · ‎04-15-2020

That has been answered in another post. https://live.paloaltonetworks.com/t5/General-Topics/Panorama-Firewall-performance/m-p/246630#M70215

azuniga · ‎04-15-2020

That error still looks related to the Python PPA so you should be okay if you ran that bash command.

azuniga · ‎04-14-2020

That means the PPA repository for Python3.7 is not accessible run the following command to resolve it. sudo bash /var/www/html/OS/BPA/updateBPA306.sh

azuniga · ‎04-14-2020

An issue seen when working with a customer is that rabbitMQ was "exiting" upon startup. service rabbitmq-server stop -- stop the service service rabbitmq-server start -- start the service service rabbitmq-server status -- verify rabbitmq is working properly Error code seen critical information found in BOLD expedition@Expedition:~$ service rabbitmq-server status ● rabbitmq-server.service - RabbitMQ broker Loaded: loaded (/lib/systemd/system/rabbitmq-server.service; enabled; vendor preset: enabled) Active: activating (auto-restart) (Result: exit-code) since Tue 2020-04-14 14:07:19 CDT; 380ms ago Process: 85685 ExecStop=/bin/sh -c while ps -p $MAINPID >/dev/null 2>&1; do sleep 1; done (code=exited, status=0/SUCCESS) Process: 85538 ExecStop=/usr/lib/rabbitmq/bin/rabbitmqctl stop (code=exited, status=0/SUCCESS) Process: 85164 ExecStart=/usr/lib/rabbitmq/bin/rabbitmq-server (code=exited, status=1/FAILURE) Main PID: 85164 (code=exited, status=1/FAILURE) Status: "Exited." Apr 14 14:07:19 Expedition systemd[1]: Failed to start RabbitMQ broker. Apr 14 14:07:19 Expedition systemd[1]: rabbitmq-server.service: Unit entered failed state. Apr 14 14:07:19 Expedition systemd[1]: rabbitmq-server.service: Failed with result 'exit-code'. expedition@Expedition:~$ We attempted to restart the server and service multiple times however the service was never able to properly run, so a netstat was run to verify that there is not another service running on the rabbitmq service port and preventing it from running. (Default rabbitmq port = 5672) generally found within the rabbitmq.conf file. Solution: sudo service mysql stop sudo service rabbitmq-server stop A separate folder was created and we moved the files from ( var/lib/rabbitmq/ ) into that temporary folder after the service was stopped. sudo service mysql start sudo service rabbitmq-server start We first ran a restart of rabbitmq after moving the files into the temporary folder and verified it worked properly. After this verification we moved it back into the correct path and this resolved the issue. service rabbitmq-server status -- to verify the service is properly running. I believe this should resolve issues seen with rabbitmq, which affects the panordersreaders (Jobs and Task Manager) on the expedition dashboard. Special thanks to @alestevez for his assistance in finding a resolution to this issue!

azuniga · ‎04-12-2020

Okay that's great! I guess what I was asking is the total disk size given to expedition. Also the latest version of expedition is 1.1.66 I did notice you are running an older version. But I am glad you were able to resolve your own problem. Patch notes can be found here if you were interested in upgrading. https://live.paloaltonetworks.com/t5/Expedition-Articles/Expedition-Release-Notes-for-Hotfixes/ta-p/216299

azuniga · ‎04-12-2020

Hello, On your expedition dashboard GUI what does your disk usage look like? If you are full or close to being full you should resize the VM.

azuniga · ‎04-10-2020

Can you go ahead and email me at fwmigrate@paloaltonetworks.com and we can go ahead and set up a meeting to solve your problem.

azuniga · ‎04-10-2020

Hello, If you would like to import a single firewall you can do that by importing the device into Expedition (Device > add a device > import the running config) After the device is imported you will need to create a project. Project > add device as allowed you would like to import. Once the project is created go into the project and import it (import > import device) This will analyze what you imported and provide you with some suggestions on improvement. After you are done with your improvements you can export it from the project into your device via API. I hope I answered your question correctly. All of the steps can be done with either panorama or a single firewall, the process is basically the same the only difference would be the allowed devices within the project tab.

azuniga · ‎03-19-2020

Hello, Are you sure this traffic is not being initiated from the inside of your network? Utilizing the stateful firewall aspects of the Palo Alto Firewall?

azuniga · ‎03-10-2020

Hello Tusharj, Our forums contain lots of useful information that can assist you with expedition, please feel free to search for all of your answers within it. Upgrading expedition has been answered if you navigate to the link below. https://live.paloaltonetworks.com/t5/Expedition-Discussions/How-to-Upgrade/m-p/226639#M369

azuniga · ‎03-09-2020

Hello, To insure reliability I would recommend that you upgrade to the latest instance of expedition which is 1.1.60. we also have a code upgrade new feature release section within these forums that allows you to track all of the updates. Unfortunately for me I do not have experience with 1.1.10 to provide you with a definite answer.

azuniga · ‎03-07-2020

Hello, expedition is currently on version 1.1.60 and supports PAN OS 9.x

azuniga · ‎03-05-2020

I checked my file permissions on my personal VM and noticed I have permissions of 755, I am wondering if your file permissions were changed? I see that yours is 750 so it might not matter if the permissions are altered unless expedition writes to the file as other. Would you mind changing that and confirming your machine learning file path is set to /data, it should be under settings > m. learning. If you are still having issues please feel free to email us at fwmigrate (at) paloaltonetworks.com

Date Registered	‎02-11-2020 11:04 AM
Date Last Visited	yesterday
Total Messages Posted	31
Total Likes Received	6

Online Status	Offline
Date Last Visited	yesterday

Strata

Prisma

Cortex

About azuniga