About FilipElsen

Dears,   We've needed to upgrade our Panorama & firewalls for bug fixing reasons to PanOs9.1.1. Since the Panorama upgrade our migrations using Expedition are having issues: PanOS9.1.1 with Expedition: Expedition pre 1.1.56: after a merge and config import, following is the config load error on Panorama:                "job failed because of configd restart" Expedition 1.1.60: config import works, but source and/or destinations objects are missing. This occurs repetively. (80% on security and NAT rules). Is this known? Which version of Expedition is supported for PanOs9.1.1?   Best regards, Filip Elsen ... View more

Hi, I've build a great Minemeld repository which I wanted to share. Recently I've discovered Firehol which is a great aggregation of a whole lot of sources. Combining these with what is currently available within Minemeld brings an added value. It consists out of: 1. IP Blocklist: Using input provided by Firehol abuse (botscout, normshield, cleantalk etc) http://iplists.firehol.org/?ipset=firehol_abusers_1d Using input provided by Firehol attacks (snort, shunlist, normshield, darklist, botvrij, blueliv, blocklist_de*, ao). http://iplists.firehol.org/?ipset=firehol_level2 Using input provided by Firehol malware (zeus, ransomware, teslacrypt, normshield, esentire, feodo, cybercrime, bambenek, ao) http://iplists.firehol.org/?ipset=firehol_webclient Using input from DSHIELD: https://www.dshield.org/xml.html Using input from SPAMHAUS (drop and extended drop) https://www.spamhaus.org/ => Processed so all unique values are listed only once: BLOCKLIST_PROC => provided into 1 output: BLOCKLIST_OUT       2. Anonymizers & open proxies Using anonymizers provided by Firehol (roxy, maxmind, onion, dronebl, ao) http://iplists.firehol.org/?ipset=firehol_anonymous Using open proxies provided by Firehol (tor, proxyz, ao) http://iplists.firehol.org/?ipset=firehol_proxies => Processed so all unique values are listed only once: ANONYMIZERS-OPENPXY_PROC => provided into 1 output: ANONYMIZERS-OPENPXY_OUT         Office 365 IP list (O365-OUT) Office 365 URL list (O365-OUT-URL)       Azure public ip blocks (AZURE-OUT) 5. All ip blocks of MICROSOFT   This config can be imported using the backup below. It's password protected with "paloalto".   Download from Githup  Or download below.   Best regards,   ... View more

Hi guys, I'm using the FW-logs in order to transform the security policies from legacy services towards app-id. ML logs are onto the system etc. Analysing rules via: R-click / App-id adoption / retrieve app (slow-fast) works fine. Fi. Apps Splunk, ms-kms are detected. When I convert the rule using "App-ID reconciliation / recommended", the service is converted to the detected app-id as-is. However application dependencies are not taken into account? fi. Splunk depends on web-browing, sms-kms depends on  msrpc-base. This is leading to non-working policies.   I'm using Expedition: 1.1.42 (VM) and 1.1.46.1 (Physical server) both have the same behavior, while I believe this used to work in previous versions?   Thanks a lot, Filip Elsen   ... View more

Hi guys,  I've followed your article to install Expedition on a Ubuntu 16.04 LTS server in order to benefit from a full sever capacity (DL-DL380-G9) - it worked great. > 24 cores, 256GB RAM, 6TB hdd. The aim is to use it for complex migrations, but also for Rule Enrichment/App-id adoption. Are there settings to be updated so that Expedition can utilize the full capabilities of the server? Thinking about fi: /etc/php/7.0/apache2/php.ini   Thanks a lot in advance, Filip Elsen ... View more

Hi,   When migrating from Checkpoint to Palo Alto, the section titles within the security policy are becomming tags - which is perfectly fine. On the NAT policy however, section titles are not taken into account and not migrated to tags. This brings on manual work for configuring those tags, apply them on NAT rules in order to filter/group rules.   Is this something that can be added?   Thanks a lot, Filip Elsen ... View more

Hi, I'm using Expedition 1.1.12 and PanOs 8.1.7. Since some time I fail in creating the ZONES via Expedition/API. This while the creation of subinterfaces, Virtual router etc is working fine. When sending the zone config by API, following message is received: (if this zone config is removed out of the config, it's another one it's complaining about....) This while the subinterfaces are existing correctly and the were created by API. However on the related subinterfaces I notice the VSYS info is missing (should be vsys4 in this case): (vsys is set to none) When entering each subinterface, the vsys is there, but it doesn't show up in Network/Interfaces overview (see previous screenshot).   After clicking the drop down selector at Virtual System and selecting the very same item, the info appears in the overview (vsys is set to "GINET")   Since I was suspecting this to be the root cause my zone creation issues, I've re-sent the API commands from Expedition, exactly as tried initially and it worked perfectly.     Seems like a bug? But for now, I have a workaround.   Best regards, Filip             ... View more