About FilipElsen

FilipElsen · ‎06-12-2020

Hi @lychiang, Yes - indeed. The base config is the one from 9.1.2. When importing the merged config: OK. When loading the imported config, we select: - Load shared objects -Select device group & templates: only the specific DG (MGT) has been selected. The policy is loaded, but sources & destinations (objects) + services are missing. Best regards, Filip

FilipElsen · ‎06-05-2020

Hi @lychiang @dgildelaig With PanOS 9.1.2 the import itself works, the configd restart error is solved. Nevertheless it takes a lot of time. When reviewing the policy, we noticed that again the source/destination/service objects got lost, even though the are found into the XML. Example 1 Expedition Panorama Example2: Expedition Panorama I've made a search in the XML for "rule 229" above, but this seems to hold the correct values. Seems like compatibility is lagging with PanOs 9.1.X. We're blocked on our migrations. Can you please shine a light? Thanks a lot, Filip Elsen

FilipElsen · ‎06-04-2020

Hi @lychiang @dgildelaig @DamienDove , Our Panorama's have been upgraded from 9.1.1 to 9.1.2. The merged config file has been imported, it takes a while! 2020/06/04 16:08:13 16:08:13 186939 BuildXMLCache ACT PEND 47% 2020/06/04 16:07:26 16:07:26 186938 BuildXMLCache ACT PEND 69% 2020/06/04 16:06:48 16:06:48 186937 BuildXMLCache ACT PEND 93% 2020/06/04 16:06:13 16:06:13 186936 BuildXMLCache ACT PEND 99% 2020/06/04 15:29:33 15:29:33 186935 Load ACT PEND 99% In total it took about 35 minutes that the process was on Load / PEND at 99%. In the end, the import worked. Thanks a lot for the solution! Best regards, Filip Elsen

FilipElsen · ‎06-03-2020

Hi @lychiang, @dgildelaig We have an M500 cluster with full disk extension. I was never a big fan of the "partial" and it showed off again today. While loading the partial config, the primary Panorama became unresponsive and I needed to failover & revert. Such symptoms I encountered in the past, therefore I avoid to do it like this command. It has been going fine for +1Y and we've performed about 21migrations (Checkpoint Central policy sent to 2 different datacenter clusters, which brings quitte some complexity (routing, nat, auto-zone assign etc). (Spoke @dgildelaig about this during an event). I've provided the export of the project, the merged xml. Can you please shine your wisdom on it? Best regards, Filip

FilipElsen · ‎06-02-2020

Hi Didac, Right! We don't do this command often, which is good 🙂 Best regards, Filip

FilipElsen · ‎06-02-2020

Hi, @sjanita @aestevez @dgildelaig During the last COVID months, our migrations were put on hold and restarted last week. The Firewalls & Panorama are on 9.1.1 In Expedition version: 1.1.60, Loading the merged configuration in Panorama worked. Committing the configuration in Panorama worked. Only this version had an issue since it was removing the source-ips, destination-ips and ports while merging the config. Similar like @DamienDove. 1.1.69.2 In this version, the config merge etc is working. Loading the merged config into Panorama following error is received: Can you please have a look, we're blocked for the moment. Thanks a lot, Filip Elsen

FilipElsen · ‎06-02-2020

Hi @DamienDove No - the issue is not solved. When loading the migrated config, it works, but when performing a commit we get an error: "job failed because of configd restart" Best regards, Filip

FilipElsen · ‎06-02-2020

Hi @lychiang, During previous COVID months, migrations were put on halt, but are restarting as of last week. The firewalls and Panorama are on 9.1.1 We're on Expedition: 1.1.69.2 and still have issues. The config had been prepared as before, but when importing it into Panorama we always hit: "job failed because of configd restart" Best regards, Filip

FilipElsen · ‎05-27-2020

Found the solution/root cause. The auto-zone assign did not work, since amongst the 1828 routes, no default route (we don't need it) was present. When adding a (dummy) default route, the auto-zone assign works. Best regads, Filip Elsen

FilipElsen · ‎05-27-2020

FilipElsen · ‎05-27-2020

Hi, @sjanita @aestevez @dgildelaig We had a huge amount of Checkpoint clusters to be migrated (26) to Palo Alto. They’re reaching the end : 23 cluster migrated – 3 to be done. With one of the 3 remaining, our 'management' cluster, we hit an issue/limitation ? This is the cluster with the most heavy policy, routing etc : 15K objects, 3289 security rules, 315 subinterfaces and 1828 routes….. When performing the auto-zone assign on the security rules, it doesn’t work at all. When performing the auto-zone assign on the nat rules (115), it’s working fine. Even when using the auto-zone assign with 1 rule at the time, it doesn’t work. Is there a limitation : parameter/memory/…. And can it be modified? I'm using Expedition on dedicated HW (also used for ML & Rule enrichment) and have therefore extra capacity (24cores, 256GB RAM, 6TB disk) 315 subinterfaces, 1828 routes Thanks a lot, Filip

FilipElsen · ‎03-11-2020

Hi Lychiang, We'll give it a go and will let you know the result. At the time of the last migration, the latest Expedition version was 1.1.60, which has issues with PanOs9.1.1. Best regards, Filip Elsen

FilipElsen · ‎03-10-2020

Dears, We've needed to upgrade our Panorama & firewalls for bug fixing reasons to PanOs9.1.1. Since the Panorama upgrade our migrations using Expedition are having issues: PanOS9.1.1 with Expedition: Expedition pre 1.1.56: after a merge and config import, following is the config load error on Panorama: "job failed because of configd restart" Expedition 1.1.60: config import works, but source and/or destinations objects are missing. This occurs repetively. (80% on security and NAT rules). Is this known? Which version of Expedition is supported for PanOs9.1.1? Best regards, Filip Elsen

FilipElsen · ‎02-06-2020

Hi, I've build a great Minemeld repository which I wanted to share. Recently I've discovered Firehol which is a great aggregation of a whole lot of sources. Combining these with what is currently available within Minemeld brings an added value. It consists out of: 1. IP Blocklist: Using input provided by Firehol abuse (botscout, normshield, cleantalk etc) http://iplists.firehol.org/?ipset=firehol_abusers_1d Using input provided by Firehol attacks (snort, shunlist, normshield, darklist, botvrij, blueliv, blocklist_de*, ao). http://iplists.firehol.org/?ipset=firehol_level2 Using input provided by Firehol malware (zeus, ransomware, teslacrypt, normshield, esentire, feodo, cybercrime, bambenek, ao) http://iplists.firehol.org/?ipset=firehol_webclient Using input from DSHIELD: https://www.dshield.org/xml.html Using input from SPAMHAUS (drop and extended drop) https://www.spamhaus.org/ => Processed so all unique values are listed only once: BLOCKLIST_PROC => provided into 1 output: BLOCKLIST_OUT 2. Anonymizers & open proxies Using anonymizers provided by Firehol (roxy, maxmind, onion, dronebl, ao) http://iplists.firehol.org/?ipset=firehol_anonymous Using open proxies provided by Firehol (tor, proxyz, ao) http://iplists.firehol.org/?ipset=firehol_proxies => Processed so all unique values are listed only once: ANONYMIZERS-OPENPXY_PROC => provided into 1 output: ANONYMIZERS-OPENPXY_OUT Office 365 IP list (O365-OUT) Office 365 URL list (O365-OUT-URL) Azure public ip blocks (AZURE-OUT) 5. All ip blocks of MICROSOFT This config can be imported using the backup below. It's password protected with "paloalto". Download from Githup Or download below. Best regards,

FilipElsen · ‎02-03-2020

Hi Didac, Thanks for the feedback. Mail sent with all details as requested. Best regards, Filip Elsen

Member Since	‎11-01-2016 12:03 PM
Date Last Visited	‎07-29-2020 09:18 AM
Posts	28
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎07-29-2020 09:18 AM

About FilipElsen

Re: Expedition support for PanOS9.1.1

Re: Expedition support for PanOS9.1.1

Re: Expedition support for PanOS9.1.1

Re: Expedition support for PanOS9.1.1

Re: Expedition support for PanOS9.1.1

Re: Limitations for auto-zone assign?

Re: Expedition support for PanOS9.1.1

Using MineMeld to Create a Custom Miner

Machine Learning Configuration Guide

Re: Support on PANOS 9.*

Re: Expedition support for PanOS9.1.1

Re: Expedition support for PanOS9.1.1

Re: Expedition support for PanOS9.1.1

Re: Expedition support for PanOS9.1.1

Re: Expedition support for PanOS9.1.1

Re: Expedition support for PanOS9.1.1

Re: Expedition support for PanOS9.1.1

Re: Expedition support for PanOS9.1.1

Re: Limitations for auto-zone assign?

Re: Limitations for auto-zone assign?

Limitations for auto-zone assign?

Re: Expedition support for PanOS9.1.1

Expedition support for PanOS9.1.1

Minemeld Extensive Blocklist - Anonymizers - O365 - Azure

Re: App-id Adoption & App-id Reconciliation

Network Security

Cloud Security

Security Operations

About FilipElsen