About rkoenig

Sorry this may be cross posting but as of June 8th we successfully installed Expedition in Azure using the manual method of standing up an Ubuntu Server from the Azure store and following some guidance from the following post/articles https://live.paloaltonetworks.com/t5/expedition-articles/expedition-documentation/tac-p/332467#M226 https://live.paloaltonetworks.com/t5/expedition-articles/new-expedition-installation-procedure/ta-p/... https://conversionupdates.paloaltonetworks.com/expeditionInstaller.tgz When we attempted to run the script we were prompted to " to create the 'expedition' user via adduser" once we created the user we re-started the script and it completed. Upon completing this process as described in: https://live.paloaltonetworks.com/t5/expedition-articles/new-expedition-installation-procedure/ta-p/... we attempted to access the URL and ran into an Apache error as described in another post, we then used the following commands sudo apt-get update sudo apt-get install expedition-beta sudo bash /var/www/html/OS/BPA/updateBPA306.sh after the updates we were able to get to the URL and login, now I just want to have our server/azure admin take a snapshot before I go about hardening the system in case I hose things up. Thanks to everyone who shared their issues and going through the trials and tribulations so that we could succeed.  LOL. ... View more

Greetings, I just wanted to add that we used the following process as mentioned in several individual posts above. Downloaded the script, unpacked the files as stated in the Expedition_Installer_July_2019 PDF https://live.paloaltonetworks.com/t5/expedition-articles/new-expedition-installation-procedure/ta-p/275276?attachment-id=8128 https://conversionupdates.paloaltonetworks.com/expeditionInstaller.tgz Upon completing this process we attempted to access the URL and ran into an Apache error as described in another post, then we used the following commands (after creating a security policy on the firewall to allow the traffic)   sudo apt-get update sudo apt-get install expedition-beta sudo bash /var/www/html/OS/BPA/updateBPA306.sh after the updates we were able to get to the URL and login, now I just want to have our server/azure admin take a snapshot before I got about hardening the system in case I hose things up. Thanks to everyone who shared their issues and going through the trials and tribulations so that we could succeed.  LOL. ... View more

We have a similar policy like that, acces to online storage is denied through our default Internet URL policy. We have another policy that allows access to online storage if you are a member of a specific AD group. We also have a "read-only" policy that allows everyone access to the approved applications within online storage category and underneath the read-only policy is another policy that denies upload via app ID. I know that theorhetically we do not need the extra policy denying upload but I think it adds an extra layer of security. Hope that makes sense.  ... View more

Hmmm I thought you could choose ANY in Filetypes, Im assuming that even when you do choose ANY it still doesnt work?  ... View more

Thanks guys, cant believe it's been two years since I last checked up on this post.  I will have to check up on the policy to see if we still have unkown-tcp traffic hitting the policy. ... View more

That is what I usually do when troubleshooting, create a rule specifically for my traffic, access the sites and then review firewall traffic to determine the application used.   ... View more

Apparently this is a known issue.  ... View more

Same question here but regardless of the /32 it has been working on Panorama and is still working correctly on the firewalls even with the /32 for a few years. https://live.paloaltonetworks.com/t5/General-Topics/Dispaying-object-name-in-traffic-monitoring/m-p/132812#M47126 The problem is that it stopped working and how do you resolve it or troubleshoot it?  ... View more

Yes, fortunately the PAN automatically conducted a PCAP on the unknown-tcp packets, those have been exported and submitted to tech support as well.  One interesting thing is that the byte size of the packets that were allowed were consistantly 374 bytes, the traffic that was denied and identified as "unknown-tcp" is above 374 bytes, sometimes 10.8K, most of the time 15.3K.  I dont know if that contributes to the problem or not. As I mentioned below our HL7 Server Admin stated: HL7, most if not about all, messages begin with the “MSH” segment, Message Header. These files, the HGS Meditech Lab Charge files, are in an HL7 batch. The first segment is “FHS” – File Header, the BHS – Batch, then MSH and all the data. So it is a “Batched” HL7 file, first time in 20+ years of doing this that I run across a charge file like this ... View more

Yes, they are required to use seperate ports for each customer, the ports will be defined between the HL7 server admins at each site.   Since we are in the testing phase I may go back and configure the security policy back to allow HL7, however none of the traffic is being defined as HL7, it states incomplete in the application column.  As I mentioned sometimes the firewall identifies the traffic as HL7 sometimes it says incomplete, in this case it said unknown-tcp. Initially the security policy specific HL7 & application default, 99% of the traffic passed, even when the application was categorized as incomplete.  It's only the traffic that was "unknown-tcp" that was getting denied. Then I tried HL7 and ANY - same problem. Then I try ANY application, ANY port - same problem. Then I created a policy to allow "unknown-tcp" I dont believe I should have to do that because a policy that allows ANY application over ANY service/port should be sufficient.  Correct?  Now traffic passes but I would like to get to the root of the issue thus the reason I opened a ticket and posting here to see if anyone else experienced the same or similar issue or perhaps there is a way to improve the PA firewall ability to properly detect HL7 traffic.   ... View more

Yes, we have usually set the updates to occur through dynamic updates every wednesday.  You bring up another interesting point in that some but not all of the traffic is identified as HL7.   I do have a case opened, I thought I would post in the community to see if anyone else was experiencing the issue.  I would love to be able to use the HL7 application for ALL traffic vs specifying ports.  ... View more

Yes sir.  ... View more