This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About sidetrack
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About sidetrack
06-25-2019
13Posts
1Like
0Solutions
Jun 25, 2019Last Visited
User
Activity
User
Profile
Latest posts by sidetrack
| Subject | Views | Posted |
|---|---|---|
| 2888 | 04-11-2019 12:18 AM | |
| 2868 | 04-11-2019 12:08 AM | |
| 5280 | 04-07-2019 10:49 PM | |
| 18537 | 04-04-2019 04:40 AM | |
| 18550 | 04-04-2019 02:53 AM | |
| 18738 | 04-04-2019 12:51 AM | |
| 18759 | 04-03-2019 04:05 PM | |
| 22632 | 04-03-2019 05:24 AM | |
| 3533 | 01-22-2019 07:58 PM | |
| 3534 | 01-22-2019 07:56 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 04-11-2019 12:18 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 4 Likes |
User Badges
Community Statistics
| Member Since | 07-16-2018 06:05 PM |
| Date Last Visited | 06-25-2019 11:24 PM |
| Posts | 13 |
| Total Likes Received | 1 |
04-11-2019
12:18 AM
1 Kudo
It's worse than I thought - Panorama will rename the zone in Shared Policies regardless of whether the device in question is a target for the rule. What started out as a simple idea turns out to be bigger than Ben-Hur, a change of epic proportions for a truckload of PA-220's, 500's (signing my life away to commits), 850's, a couple 3220's and some VAs. All to make policy management simpler. There must be an easier way?
... View more
04-11-2019
12:08 AM
After a company acquisition we have inherited about 25 firewalls which I have recently migrated to a single Panorama instance, along with shared policies and templates, and in the process of building shared policies for the entire fleet. For the shared policies to work, zone names need to be consistent across about 40 odd gateways, unfortunatley there is a mix of zone names and not all the devices use the same zone for the same function (e.g. in some cases Global Protect clients terminate in the VPN zone as do L2L VPNs, I want to move the L2L VPNs to the trusted zone instead, some gateways use outside, others use untrusted etc.) So I am embarking on a mass zone-rename task, which is relatively daunting considering access to some remote gateways is via SDWAN to a device behind the firewall, and renaming these zones will affect SDWAN connectivity. Those are in the hard basket I will probably use temporary VPNs to manage the transition. For the simple gateways i.e. access TO the firewall is not THROUGH it, I have a direct path to the management interface. Renaming zones on these sound simple, especially when Panorama will rename the zones within policies too. This is great for the local Device Group, where policies will be updated with their respective zone names, however I have found Panorama will rename instances of the zone in use in all policies inherited by the gateway, including the Shared Policy - we have already acommodated several different zone names in the shared policy and I do not want the shared policy to be modified as it applies to many other gateways, so renaming the zone on one managed device has the potential to affect all managed devices through the shared policy change. Is there any way I can avoid the change to the shared policy? Or must I preview the changes and back-out the shared policy changes that took effect when renaming the zone? This should be the easy part... renaming zones on remote gateways where access to the device is through it will be a real challenge 🙂
... View more
04-07-2019
10:49 PM
@alestevez I'm considering trying to do this in the DB instead, if there's a way I can dump the table that contains the invalid 'shared' polciy and import it into the vsys1 table?
Any hints? 🙂
Matt
... View more
04-04-2019
04:40 AM
Thanks for the tip sjanita!
Looks like this is my only option, although the individual cells have carriage returns for multiple entries. I'm sure with a bit of NP++-fu I can whip this into shape 🙂
... View more
04-04-2019
02:53 AM
I was trying to avoid that 🙂
A good chunk of my rules were hand-rolled in Expedition, stupidly evolving this unusable policy.
I need a way to export these orphaned shared rules, if there was a way to move them from shared to vsys1. We can do the reverse (convert a rule in vsys1 to shared) but not the other way around.
... View more
04-04-2019
12:51 AM
I'm running expedition-beta/unknown 1.1.11 amd64
I can replicate in an entirely new project, importing a VA base config (it can only have one vsys 🙂 )
It has existing rules in vsys1, but we'll demonstrate by importing a simple CSV into the shared vsys:
dns;trusted;dns-server;Internet;8.8.8.8;dns;permit
This won't work if no vsys is selected (all), the list pops up and you can select from shared and vsys1 - even though shared is not supported for Security Rules.
Import CSV, must select from shared or vsys1 select shared (oops!) it worked...? here be the shared rule... unset base config, no shared policy to export 😞 no shared policy in output (it's not exactly valid)
... View more
04-03-2019
04:05 PM
Thanks @alestevez ! Unfortunately I am unable to cut and paste the rulebase in Expedition - ctrl-c / ctrl-v doesn't seem to work and there's no cut/paste in the rule context menus.
The Move button would be great if it supported move to a different rulebase like Panorama but it doesn't have the option.
Any other ideas?
... View more
04-03-2019
05:24 AM
I have ended up in a bit of an odd situation with an undesirable result 😕
In the process of importing CSV's from an unsupported source, I have ended up importing an entire rulebase into the "shared" VSYS of a standalone base firewall config. This might be OK for objects, or a rulebase in Panorama, but not a valid config for a standalone device.
To make matters worse, I have augmented the policy with a ton of new rules from a design document - mostly manual work. Many hours have gone into this and it's now ready to export to the target gateway.
Only one thing - there is no shared policy in the export (I guess because it's not a valid thing).
The policy can still be editied in config.xml -> shared, all I need is to move the rules to vsys1 or get them in the exported xml. I don't have time to build this rulebase again.
Help me @alestevez, you're my only hope!
... View more
01-22-2019
07:56 PM
I stumbled across two potential bugs in Expedition 1.0.107 the other day, using it to merge duplicates and unused objects from a Panorama (8.1.5) config.
1. Editing a config that originally contained over 10,000 objects (across different DGs) resulted in some shared objects being defined twice - this was after merging duplicate and removing unused objects, the config imported to Panorama would not commit and resulted in an error "objecet already exists". We found the object was defined twice in the shared candidate config:
<shared>
<address>
<entry name="test.com">
<fqdn>test.com</fqdn>
</entry>
<entry name="test.com">
<fqdn>test.com</fqdn>
</entry>
</address>
</shared>
And also defined twice within the shared config in the output from Expedition:
<entry name="test.com"><fqdn>test.com</fqdn></entry><snip/><entry name="test.com"><fqdn>test.com</fqdn></entry>
We couldn't manually remove the duplicates from the XML as there were at least two more if not hundereds of these duplicated entries. After some manipulation of the source XML I got the object count down to about 4,000 before merging duplicates in Expedition, after which the exported config was fine until we hit the next bug.
2. Authentication rules failed to commit due to an invalid log-authentication-timeout. Appears Expedition introduced this log-authentication-timeout setting with no values as it did not exist in the imported config and was not accepted by Panorama 8.1.5:
<pre-rulebase>
<authentication>
<rules><entry name="example"><snip/><log-authentication-timeout/><timeout>60</timeout><snip/></entry></rules>
</authentication>
</pre-rulebase>
The workaround was to remove the log-authentication-timeout entries in the XML.
@aestevez I can share the raw and optimised configs if you need.
... View more
01-14-2019
07:09 PM
Thanks for raising this, I have had the same question only to find out by trial and error. With the merge function I have found if an element can only have a single entry or configuration the name of which already exists in the config, it effectively REPLACES that element in the destination x-path. Where an element can have multiple entries (e.g. groups) the merge function will COMBINE the existing config with the new. Understanding this is helpful in case you have existing elements with the same name. I believe the Append function is designed for policies only, where the imported config is tacked on the end of the existing althouhg I would expect this to have the same result as a merge, especially when an existing rule has the same name (you can't have two rules with the same name even in a candidate config - the 'new' rule is probably going to merge with or replace the existing - I would suggest more trial and error or more consise documentation from PAN 🙂 I have done all my optimisation off-site so never had API access to the customer equipment, should that be the case I have no idea what would happen when pushing the conifg to Panorama via the API - would this merge, append or replace the destination element / stanza?
... View more
10-07-2018
08:29 PM
I get several PHP Fatal errors and warnings on upgrading expedition-beta, I can't tell if the upgrade was successful.
Is this normal or is my Expedition VM broken?
Setting up expedition-beta (1.0.106) ... PHP Warning: mysqli::__construct(): (HY000/2002): No such file or directory in /var/www/html/libs/database.php on line 22 PHP Fatal error: Database connection failed: No such file or directory in /var/www/html/libs/database.php on line 24 its recommended to run after install: apt-get -y -f install its recommended to run after install: sudo apt-get autoremove Checking for old projects and Devices what are not Encrypted PHP Fatal error: Uncaught PDOException: SQLSTATE[HY000] [2002] No such file or directory in /var/www/html/libs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:43 Stack trace: #0 /var/www/html/libs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php(43): PDO->__construct('mysql:host=loca...', 'root', 'paloalto', Array) #1 /var/www/html/libs/vendor/illuminate/database/Connectors/Connector.php(64): Doctrine\DBAL\Driver\PDOConnection->__construct('mysql:host=loca...', 'root', 'paloalto', Array) #2 /var/www/html/libs/vendor/illuminate/database/Connectors/Connector.php(43): Illuminate\Database\Connectors\Connector->createPdoConnection('mysql:host=loca...', 'root', 'paloalto', Array) #3 /var/www/html/libs/vendor/illuminate/database/Connectors/MySqlConnector.php(24): Illuminate\Database\Connectors\Connector->createConnection('mysql:host=loca...', Array, Array) #4 /var/www/html/libs/vendor/illuminate/database/Connectors/ConnectionFactory.php(183): Illuminate\Database\Connectors\MySqlConnector->connect(Array in /var/www/html/libs/vendor/illuminate/database/Connection.php on line 664
Fatal error: Uncaught PDOException: SQLSTATE[HY000] [2002] No such file or directory in /var/www/html/libs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:43 Stack trace: #0 /var/www/html/libs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php(43): PDO->__construct('mysql:host=loca...', 'root', 'paloalto', Array) #1 /var/www/html/libs/vendor/illuminate/database/Connectors/Connector.php(64): Doctrine\DBAL\Driver\PDOConnection->__construct('mysql:host=loca...', 'root', 'paloalto', Array) #2 /var/www/html/libs/vendor/illuminate/database/Connectors/Connector.php(43): Illuminate\Database\Connectors\Connector->createPdoConnection('mysql:host=loca...', 'root', 'paloalto', Array) #3 /var/www/html/libs/vendor/illuminate/database/Connectors/MySqlConnector.php(24): Illuminate\Database\Connectors\Connector->createConnection('mysql:host=loca...', Array, Array) #4 /var/www/html/libs/vendor/illuminate/database/Connectors/ConnectionFactory.php(183): Illuminate\Database\Connectors\MySqlConnector->connect(Array in /var/www/html/libs/vendor/illuminate/database/Connection.php on line 664
... View more
07-16-2018
07:13 PM
I've done this in Panorama without using Expedition, by loading partial configs from one DG to another by loading a partial configuration from the source device group in the running-config as per https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-move-or-copy-objects-in-configuration-from-one-location/ta-p/71904
You need to start with the dependencies i.e. tags, addresses, address groups, apps, app groups, profiles, profile groups etc. then you can copy the policy. You can copy all pre- or post- rules at once by using the pre-rules or post-rules Xpath.
I found an old tech note for PAN-OS 6 quite helpful for this process https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Panorama-Device-Migration/ta-p/62527 even though the device migration process is largely automated today.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-25-2019
11:24 PM
|
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks