About AlexNC

@Alabrir  Indeed, we heavily use Expedition for migrating from other vendors and also for M Learning and other Tasks. There are a few things desired in Expedition but we understand that Exp. 1.0 won't get much love in regards to new features and functions. So yes! Expedition 2.0 is highly anticipated by us. Not getting any info is indeed worrying, specially since there once was the download and install available a longish time ago and then got pulled. Cheers Alex ... View more

We are facing the same issue after upgrading to 10.2.3 But in our case the Spyware profiles do not match. Spy-Alert-Only = crit,high,med to Alert (rest is default) Spy-Outbound ) crit,high  to reset-both / med,low,inf to Alert So the profiles are not the same, but still we get the working that our Alert Profile is a duplicate of our Outbound. Is that also expected buggy behaviour    Cheers Alex ... View more

Hi PavelK   Yes I've just read it this morning. Guess their creative licensing department realised what a big stir fry they caused with their decision to reduce the number of security-zones from the top model downwards.    Glad to see we are back to previous PA3200 specs when it comes to security-zones. Now all they need to do is get off their subscription chaos bandwagon and come back to earth again. ... View more

@Alabrir   I sure hope not that Expedition 2.0 or for that matter MineMeld (local install, or they give us a SaaS EDL Manager that covers MineMeld) is one of them. I see many competitors beefing up their migration tool efforts in a way to gain customers and make the transition as easy as possible. Now not all migrations are good migrations and a **bleep** ASA config will end up a **bleep** PAN config.  But if done right tools like Expedition can be a huge selling point to get a customer to go for Palo and not just lifecycle up with his existing vendor. Not to speak of doing house cleaning of existing or old PAN installations out there. Specially since PAN-OS and Panorama are lacking a HUUUGE amount of security-rule manageability. I remember how last year the Expedition 2.0 pan.dev page even had the instructions how to install it and use it with what was working back then. Now it is dead silent and no work about it anymore.  It does worry one a bit.   Anyhow I do appreciate the effort that's been put into 1.0 and 2.0 so far and I greatly enjoyed using the 1.x version so far. Palo Alto needs to make it an official and fully supported tool in their arsenal or tools. This way it might also get you guys the necessary time and funding to move forward more efficiently.   best regards Alex ... View more

Yes I hope they can fix this in the future and at least give us the 200 form the 3200 Series. Also the comparison tool and summary spec sheet are still not updated to show the new PA-1400 Firewalls UPDATE: I stand corrected: the new PA-1400 and the new PA-415/445 are now in the comparison tool finally: https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-3410,pa-3430,pa-3420,pa-1410,pa-1420,pa-415,pa-445      It's great that we can order them already, but I'd appreciate if I'd now what I buy before I pull the trigger. Especially since we learned from the PA-3400 Series, we might get a cutback in specs compared to the previous models. So knowing what we are actually spending our money on becomes even more important. ... View more

Dear Sharan   Right now the snooze is not usefull the way it is implemented, but I am looking forward to the roadmap and the change you mentioned. Being able to permanently disable/snooze an alert for a specific profile will be very welcome.   Thank you and best regards Alex ... View more

If I may add my 2 cent here. While I can agree on the fact that Palo Alto is not aware of what a URL filtering profile is used for. A new category like ransomware should at least be implemented as "alert" for all URL filtering profiles that are detected Palo Alto is all about security. therefore to me as a customer. I would expect such a URL category to be blocked by default, or that I would have to manually enable that new URL category. Now in regards to Encrypted-DNS i see how that might be a more tricky case and I could understand to have it as "Alert" only. But what I would never want from a newly created URL category, to be implemented in my URL Profiles set to "ALLOW" that is by far the worst of them all.   Regards Alex ... View more

@lychiang  Any update on a Q1-4 for 2023? or maybe even a x-mas present for 2022 still? Will there be a Beta to join?   Best regards Alex ... View more

Hi Lychiang   In my case I was installing Expedition fresh on a Ubuntu 20.04 (i cannot remember which Expedition version it was initially). Also in my case php7-radius was not installed and after following your instructions I had to run the following command: sudo apache2ctl restart Regards Alex ... View more

Heya We've gotten the following workaround to fix our issue with 10.1.5h1 on Panorama. > Panorama will need to perform a commit fix and apply some transforms using the transform script. Resolution: > Run the following CLI commands to resolve the validation error, 'hip-profiles expected here'. >configure #load config from running-config.xml  #commit force <<   This workaround is by far better then the copy replace in notepad workaround for all the wrong rules. Anyhow, even though the fix is quick and simple. One would wish Palo documentation would be update and well documented for this. Also a hotfix for the hotfix would be appreciated.   Best regards Alex ... View more

We are facing the issue now to, after upgrading from 10.1.3 to 10.1.5h1. Downgrade to 10.1.4h4 as suggested would not fix the OpenSSL vulnerability:  https://security.paloaltonetworks.com/CVE-2022-0778 From the looks of it, this bug was fixed in 10.5.0: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-release-notes/pan-os-10-1-5-known-and-addressed-issues/pan-os-10-1-5-addressed-issues# PAN-171869 Fixed an issue where HIP profile objects in Security policies and authentication policies were replaced with source HIP and destination HIP objects.   After hitting already lovely bugs with 10.1.3 and 10.1.4 with device tag assigned security rules and dynamic object groups. 10.1.x looks like a bullet proof release of PAN-OS. Regards   ... View more

Great to hear,   In the meantime we have been told that in our case it will be fixed with 10.1.5 which should come out early march. We've been told to deploy/push 1 Device-Group a time for devices running 10.1.x    Regards Alex ... View more

Hey PozsonyiAttila   I am facing the same issue as you do. Panorama with 10.1.4h2 and firewalls running 10.1.4 (before when the issue started we had 10.1.3 running). This only happens to the firewalls running 10.1.3/4, all firewalls currently running 10.0.x do not face this issue.   what worries me the most, is that one does not see the rules being deleted when doing a push preview before deploying. We have a TAC open and it is also under investigation. This all started with 10.1.3 (which we upgraded because of new PA400 firewalls and log4j fix. We upgraded to 10.1.4h2 by TAC recommendation, which actually made us face the issue with dynamic object groups, which had to be fixed with a creating and deleting a dummy object that uses a tag.   Let's hope they soon find the issue for it and provide a fix. Regards Alex ... View more