About mike_lutgen

I understand what the technology does, that is not what my question was. My question was about identifying which threats have been mitigated by the Wildfire signatures vs the Threat Prevention signatures. ... View more

If you are using the Migration tool, migrating from Cisco is fairly straightforward, the only thing that won't migrate for you is the NAT rules.  Recreating those is pretty straightforward though just be sure to use the bi-directional checkbox since I think that's how most/all Cisco NAT rules are. ... View more

Hello, This is not a terribly difficult task if you are familiar with how NATing generally works on the PAN firewall.  There is one main thing that you will need to make sure though - that the tunnel interface you specified for the tunnel is in a separate zone from the traffic that will be going across the tunnel.  As long as you have this done, you will build the NAT rule like this: Source Zone: <your source traffic zone(s)> Destination Zone: <your VPN tunnel interface zone> Source Address: any (or restricted to a specific IP if you like) Source Translation: You have a couple of options here depending on exactly what traffic you are sending across.      1. If it's coming from multiple hosts specify Dynamic IP and Port and then Translated Address.  In the area where you specify an address, either select/create an address object for the address that you are NATing to, or you can just type an address in the field as well.      2. If it's coming from a single host, you can do the first option, or you can specify it as Static IP and then in the Translated Address area, specify/create an address object for the address that you are NATing to or again, you can just type an address into the field. This is all you should have to do, the rule will look very much like your source NAT policy that translates your user traffic out to the internet except your destination zone will be the zone that your tunnel interface is in and you will not be specifying "Interface Address" as the Source Translated Address. One thing to keep in mind, if your VPN tunnel is currently in the same zone as your trusted network, when you apply a different zone to it, you will need to make sure to add the appropriate firewall rules so that traffic can flow correctly. Mike ... View more

Hi Brano, You can also export these using the following process: 1. SSH to the firewall and run the command set cli config-output-format set 2. Enter the command configure to enter configuration mode and run the command show address-group <address-group object name> This will display the section of the configuration relating to that address group, you can copy it out from there and do what you like with it.  It will display in set commands, so if you wanted to create that address-group on other PAN firewalls, you could just paste the group of set commands into the CLI and it will be created (you will have to create the address objects first though, to export those from the config as well, run show address <address object name>). Mike ... View more

Hi Albert, I am trying to convert from a Checkpoint R65, and am using the routes.txt file, below is what is in that file. Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface 192.168.101.0   0.0.0.0         255.255.255.0   U         0 0          0 eth2 192.168.102.0   0.0.0.0         255.255.255.0   U         0 0          0 eth3 192.168.103.0   0.0.0.0         255.255.255.0   U         0 0          0 eth4 192.168.11.0    0.0.0.0         255.255.255.0   U         0 0          0 eth0 216.207.173.0   0.0.0.0         255.255.255.0   U         0 0          0 eth1 192.168.0.0     192.168.11.2    255.255.0.0     UG        0 0          0 eth0 127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo 0.0.0.0         216.207.173.1   0.0.0.0         UG        0 0          0 eth1 When I attempt to use the migration tool and upload this file as my routes.txt, I get the errror: No routes.txt or empty file or cannot find the local interfaces, putting all rules in the Trust zone. Any ideas on why I would be getting this error? I am running version 1.5.4. Thanks! Mike ... View more