About Avanderheyden

Well the whole idea is to keep it transparant and not have users authenticate to anything. I do suppose that if I were to use cookies it wouldn't pick up users logging in or out, and on-demand is exactly what we're trying to avoid (with captive portals on top of the list :-)). The agent should be invisible to the end users, but if no one knows an alternative I'm guessing it will be support to confirm or a feature request... ... View more

That is pretty much exactly the configuration at the moment.. 😞 ... View more

I actually don't mind if it can't get to the portal, I just don't want users to see the message -so it's more, can I suppress the message on the client itself or not? ... View more

No, if possible we highly prefer not to have the portal externally available. ... View more

Internal host detection IPv4 is set to an internal on-prem IP and the hostname for it does not publicly resolve, plus internal gateways are configured.. ... View more

I checked and the file is indeed incorrectly formatted to JSON standards, but after running the export again, and then again on a completly other R80.10 management server, I found those were also incorrectly formatted to the standards -and hence would be 'normal'... Are you willing to take a look at it? I know the feature is in beta though. ... View more

Then AFAIK you need to base your project on the Panorama config (and import the panorama configuration), not the firewall configuration. The Panorama pushed policies are not present in the firewalls running-config.xml or candidate config either, so it's logical the expedition tool can't retrieve them either. Vice versa, you will push your changes using API calls to Panorama and from Panorama to the device. ... View more

HW platform, chassis, cloud platform? I just dumped in a relatively complex config in the Expedition tool and it read it fine here (v106)... ... View more

Have you gone, outside of a project, to devices -> choose your device -> contents -> "retrieve contents" & save first? ... View more

The tool will struggle with it, if you want to move forward fast and cannot wait, convert it to a PANOS 7 VM. From there, upgrade it to v8 and export your config, saving your security & NAT policies, objects, zones & router config in the XML. Do the rest manually or figure the syntax differences. I fear that's about the best thing you can do if you need to migrate over to the PANOS 8 platforms at the moment. ... View more

I've seen it originating from Juniper configs and basically wrote up a script to sort them on the destination PAN device itself, based on the original source config file.. Less problematic for security policies than for NAT rules though. ... View more

Could you parse the SRX config of an example NAT rule that was done correctly and an example of one that was incorrectly? Is it not by any chance always failing at the same type of NAT'ing? ... View more

I'm not sure what the Sonicwall config looks like, but if it's anywhere near readable text it shouldn't be too difficult to (shell) script you something that parses you service/address objects and possibly even security policies? It wouldn't be close to as neat as the migration tool but it's not insuperable. ... View more

Not sure about the exact error message it's throwing you, but the migration tool doesn't work (yet) with PANOS version 8.0. The XML tags have differences in between versions 6-7 and 8. My recommendation would be to download the config from the PA220 with a few dummy objects/policies, export the config from the migration tool and copy/paste manually adjusting what you paste with find&replaces. That's probably the best to do for now... ... View more

The Juniper config was imported before anything else in the tool, and just tried it again on a new project but can't seem to figure it out. It sortof leaves me to wonder how I did a correct migration (same source appliance) without running into this problem back in may/june 2016... In there, the PAN device has matching rule names/numbers between the security&NAT rulebase and appear in the correct order too...   Anyway, Thursday is fine for me. 🙂 Can you see my detailed profile for my mail address or? ... View more

Removing the names did the trick to renumber the security policies, but that doesn't seem to have touched the NAT rules order (or names).. In like half an hour or anywhere tomorrow would work for me.. ... View more

Could you help out maybe with a short remote session anyway? I'm trying to do the rightclick to do the rename of the rules (XX) but after clicking it (on one / bunch of rules) it doesn't seem to do anything at all.. ... View more

Well the funny bit is that I converted a Juniper config where it went fine, the NAT rule ID's there match the security rule ID's. If I take that very same Juniper config and try it again it goes wrong too, on different versions of the migration tool, leaving me wondering what I did different on which version.   I see your suggestion to rename the rules but it goes slightly beyond that. The order in which the NAT rules are positioned in the NAT rulebase doesn't seem to match the original config order. I'll see what happens to the NAT order when I rename the security policies (although some people are not going to like that) and get back to you. ... View more

No actually on the previous cluster I did I have a NAT policy called "Nat interface RuleID-432" and a security policy called "Rule ID 432", which matches to the Juniper config file line: set policy id 432 from "***_Hosting" to "****_Internet" "*******iis14" "Any" "http-s" nat src permit log   But now, for a similar Juniper config file line: "set policy id 1947 from "*****_Lan" to "****_Tars" "Any" "*****-docushare" "Specialinternet" nat src dip-id 10 permit log "       It created a NAT rule called "Nat DIP RuleID 2656" (where 2656 is the actual position in the Juniper rulebase) and a security rule called "Rule ID 1947". Which confuses the hell out of us at the moment. 🙂 Would you be able to join a webex to see for yourself? ... View more

I'm doing a conversion from Juniper, and the security rules are copied over nicely and have names like "Rule ID 5237". On the NAT rulebase however this is changed to "Nat interface RuleID 131" where the rule ID refers to it's position in the rulebase. The order is also out of sync.. I did another cluster with the same devices/version on the 3.3.10 version and didn't have that problem back then. Kr, Arne ... View more

Actually, I tried that ("As a test, I added a no-decrypt rule for MS/Lync URL's, but that doesn't really make a difference.") using the list of URL's & IP addresses at: https://support.office.com/en-gb/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-GB&ad=GB#BKMK_LYO   But it still seems to fail on session age-outs.. ... View more