About BOkay

Do you have an upload site I can send to? I get the following rejected email. ... Message Size Violation. Size over 50MB or over 256 attachments or zipped attachment inside with over 256 files. ... View more

Sent. Thank you. ... View more

- Are you sure that is the only rule you have selected for ML? All the rules you select for ML are considered (actually their traffic) for the suggestion of security rules Positive. I'm actually taking over a project where this was done months ago with these results. I was rerunning all these traffic analysis myself because I saw the discrepancy in the previous work and assumed they were done incorrectly but, it appears they were done correctly since I am getting the same results.   - Did the rule change during the period of time you have selected to analyze? If, in the past, you had the inbound traffic also allowed in that rule, we may be learning from traffic that in the past hit the rule I would highly doubt it for a couple reasons. These any any rules were create in haste because of a migration project, so I doubt they were modified considering how open it is already. Also, this current project is the first effort to address these any any rules since they were implemented. So if any modification was going to take place it would be to create new more secure rules above it in policy instead of modifying the rule. If you have a easy method to see if that rule has been changed I'll give it a try.   - There is something wrong in the implementation, but the specifics would be really strange, as it the source, dst, From and To fields cannot transfer values to each other in the Spark process. They are taken as different fields in the DataSet (some internal terminology, but my point is that it would be really strange go mix data among fields) Implementation of Expedition or the policy/firewalls? If you mean Expedition, we got the same results on an older version months ago. That version of Expedition was not maintained and eventually became unusable. I just recently rebuilt it and from scratch and have it on the latest version. I got the same results as the analysis that was run months ago on the older version of Expedition before the rebuild. ... View more

Adding Panorama then that button to show the individual firewalls the last piece of the puzzle I believe. Thank you!!!!    I tested going through the M. Learning of a few any any rules and I'm seeing good results. There is only one abnormality but I will create a different thread for that.   Thank you! ... View more

Yes, that is what I have outlined. That is not possible.   If I go the route where I go through Panorama via adding Panorama as the device in the Device Tab, Retrieve Contents, Retrieve Connected Devices, Retrieve Contents, and the result is a grayed out M. Learning and the message states "Process CSV logs can only be executed from FW devices." ... View more

Can you provide a screenshot of what you are referring to? I'm not following. ... View more

@lychiang @dgildelaig  The problem appears to lie in the dynamic between using individual firewalls & panorama.   You can only do HALF of the workflows depending on if you import individual firewalls vs panorama. You can ONLY do the first half of the workflow if you import individual firewalls. You can ONLY do the second half of the workflow if you import panorama. But you cannot do it ALL using either method. Meaning you would have to break everything down daily as you get new logs.     In the device tab. If you import just the individual firewalls... You can do the following: Go into the individual firewall's M.Learning tab and the Process table is ENABLED. You can process the CSV logs. You can NOT do the following: You can NOT see any of the security policy once a project is created using the individual firewalls. This means you cannot do M. Learning traffic analysis.     Now if you import Panorama In the device tab Importing Panorama *absorbs* those individual firewalls. As you can see, the individual firewalls are gone and only panorama remains in the device tab.   Now things are reversed.   You can NOT do the following: Go into the individual firewall's M.Learning tab and the Process table is DISABLED and grayed out. You can no longer process the CSV logs. This means we can no longer process new csv logs that will come in.   You can do the following: Now when you create a project you can now see the security policy, mark rules for M. Learning, and analyze that traffic.   This obviously is not a workflow that is practical. If I were to need to do traffic analysis daily I would basically have to break everything down and re-implement everything again.  I'd have to do the following daily. Delete Panorama from the device tab. (because I can no longer process new csv logs) Add each individual firewall to the device tab.  Do the first half of the workflow. (now I can process new csv logs) Add Panorama (now those individual firewalls are gone and are absorbed into panorama taking away the ability to process new csv logs) Do the second half of the workflow.  Now unless there is still something wrong with the way I'm implementing this I think there is a bug. The problem really lies in the disabling of the ability to process CSV Logs to individual firewalls when you are using Panorama. If "Process CSV logs can only be executed from FW devices." and the grayed out CSV logs were to be removed when using Panorama it should solve everything. ... View more

I followed that document and it puts me in my original situation.   If I use the individual firewall I have the ability to process the scheduled log exports that are sent to Expedition. But when you start a project and go into the policy the policy is empty.   If I use panorama I lose the ability to process the scheduled log exports as it is all grayed out for the individual firewall. But when I start a project I do have the policy but no mater what log connector I use no rules show up when I click Discovery.   I've followed the following guides with no luck.   Expedition Migration and Security Assessment Quick Start 1.1.0 Expedition New Feature: Scheduled Log Processing 1.1.21     ... View more

It's the same as my log connector. I was just making sure I went back far so that I could get as many logs as possible. You said, " traffic log you export from firewall", however. Did I miss that step? I didn't do any exports, I was under the impression the log connector was all I needed when using panorama. I scheduled the log export to the individual firewalls but that didn't work when using Panorama.  ... View more

Ah I didn't realize you had to pick a active log connector as I had several. I picked the right one and it ran but has No Data even though I know there is traffic data available via Panorama.     ... View more

By green button I'm assuming you mean "Discovery". Then I click Machine Learning.  What am I supposed to do after that? Nothing is listed and if I click Analyze Data it appears to get stuck on Initializing and crashes Expedition.  Also is "No connector selected" in the picture below normal?   ... View more