topic Re: If You Need an OVA... in Expedition Discussions

If You Need an OVA...

trice — Tue, 03 Sep 2019 18:59:14 GMT

I created an OVA for my team and put it up here (Note, this isn't the official release now offered by PANW):

https://drive.google.com/open?id=1Z9GrCF8I_BZzpbEmEh6G75npo05_4G0c

Be sure to go Settings > M. Learning > and change the Expedition ML Address address to your VM's IP.

Then return to the Dashboad and Start the Agent.

[UPDATE 6.4.2019]

Updated the OS and Expedition to 1.1.23.

There were a few new setting available with the upgrade, so a new directory /data was created and chowned to www-data.

There were resource alerts, so updated the /home/userSpace/environmentParameters.php file, so updated TotalCPUs to 2 and SparkRAM to 1592m. Moved image to S3. Note, image size has grown from allocated disk usage. I'll work on squeezing it down for the next release.

[UPDATE 2.22.2019]

I created a new OVA that is now at 1.1.6. All Ubuntu updates have been applied as well.

Permissions for the /datastore and /PALogs should work for all cases now.

VM Image was set to Version 10, so should work for VMware 5.5.

Made a change to /etc/default/grub and /etc/network/interfaces to always use eth0 instead of ensXXX.

Updated /home/expedition/update-expedition.sh to make upgrades easier.

SHA256 dad89cc3e2c031e70f548dab3bc96b84e0b2216593608dc09151159115463c65

[UPDATE 10.16.2018]

Updated Expedition to 1.0.106 and added all OS updates as well.

[UPDATE 9.18.2018]

It's been upgraded to 1.0.104, but you'll likely need to update it once installed. So just:

sudo apt-get update

sudo apt-get install expedition-beta

...or just use the update-expedition.sh script I created in the home directory.

I also fixed a couple of other issues:

Fixed the /PALogs directory permissions and updated the Parquet Path in the Machine Learning section. This fixes the "Parquet Path" error on the Dashboard.

Changed the "mysqli.reconnect" value in /etc/php/7.0/cli/php.ini to "On" to fix the mysqli.reconnect error on the Dashboard.

Re: If You Need an OVA...

magates — Wed, 05 Sep 2018 20:28:42 GMT

Let me just say that your timing is impeccable. I have been fighting to get the VM converted for esxi all day, trying to track down a Windows box I can use that has the right network access, enough disk space, admin rights, on and on. Roadblock after roadblock. Thank you.

Re: If You Need an OVA...

rdonohoe23 — Tue, 11 Sep 2018 09:53:16 GMT

Thank you for this ..

Re: If You Need an OVA...

mghazzi — Wed, 12 Sep 2018 23:13:22 GMT

I needed a version that could run on ESX 5.5, based on this KB: https://kb.vmware.com/s/article/1003746 , I needed HwVersion 10.

so I took Tobias' OVA and downgraded the Virtual Hardware Version to 10, while I was at it I updated Expedition to 1.0.104 and BPA to 3.2.0. This OVA should work with later version of ESX as well.

https://paloaltonetworks.box.com/s/mb3z1v50sw1c914z0q05gqm7y80b8w2x

Please test and let me know if any issues. I tested it on ESX 5.5 Update 3b build 3248547 (2015-12-08).

Expedition boots up with DHCP Client, so to get your currently assigned IP, log into the Console with Username: expedition Password: paloalto and use ifconfig to see your current IP.

then browse to https://<current IP> , and log in with Username: admin Password: paloalto

You should update it periodically. So just:

sudo apt-get update

sudo apt-get install expedition-beta

Re: If You Need an OVA...

bartc88 — Thu, 13 Sep 2018 21:45:27 GMT

Dont forget to change the IP address in the Machine learning server address settings due to it being OP's IP of his ML Server.

Re: If You Need an OVA...

Esfeld — Tue, 18 Sep 2018 20:12:05 GMT

I also had to do this from another thread:

/etc/mysql/my.cnf file:

bind-address = 127.0.0.1

That line should be commented out instead, like this:

#bind-address = 127.0.0.1

Re: If You Need an OVA...

bartc88 — Tue, 18 Sep 2018 20:15:39 GMT

I like using sudo nano to do this:

sudo nano /etc/mysql/my.cnf file:

--Press Cntrl+W to find "bind-address"

bind-address = 127.0.0.1

--Uncomment it as such:

#bind-address = 127.0.0.1

Cntrl +O to save it

Cntrl +X to exit, DONE!

Re: If You Need an OVA...

Chin_Shan — Wed, 19 Sep 2018 04:25:33 GMT

Thank you.

Re: If You Need an OVA...

Binh_Nguyen — Wed, 19 Sep 2018 14:04:29 GMT

Thank you so very much!!! I've spent 2 weeks trying to get the non-OVA to work. You are a lifesaver!

Re: If You Need an OVA...

willembrey-hardware — Fri, 05 Oct 2018 21:39:28 GMT

I had no ens33 interface so had to use "ip link" to realise it was ens34 because the VMX file had it as slot 34. Weird.

Re: If You Need an OVA...

mrector — Wed, 14 Nov 2018 16:32:38 GMT

I have installed this ova on my vmworkstation 12.5 (windows) and get the below network error during boot. No network connectivity. Tried both vmxnet3 & e1000 with same results. Any idea's?

Re: If You Need an OVA...

trice — Wed, 14 Nov 2018 18:24:16 GMT

I've seen this in the past, it's the virtural nic name IIRC. There are a couple of ways to fix it, change all the names to the new nic name (ens160 or ens192, etc). I've added some kernel boot options in the past, too.
Have a look at this:
https://askubuntu.com/questions/824376/failed-to-start-raise-network-interfaces-after-upgrading-to-16-04

Hope this helps!

Re: If You Need an OVA...

rkalinowski — Wed, 09 Jan 2019 18:29:47 GMT

This is aweomse, thanks! Any chance you could post the file-hash each time it's updated? Best assupmtion is that I just had a corrupt download but it would be nice to cross reference with the hash (downloaded twice today because the first one wasn't deploying in vmware due to a mismatch)

Re: If You Need an OVA...

mghazzi — Wed, 09 Jan 2019 18:34:40 GMT

The hash is already part of the OVA. and Ova is a tar of .ovf, .vmdk, and .mf. the .mf is a plain text file that contain the hashes of the .ovf and .vmdk files, so it is internally validated. hence, the OVA is so much better than an OVF that requires manual hash validation. VMWare will warn you if you launch a corrupt OVA, but will not warn you if you try to launch a corrupt OVF/VMDK .

Re: If You Need an OVA...

dberber1 — Fri, 08 Feb 2019 18:32:27 GMT

Thanks for this. The one from the link that you provided is for vsphere 6.5 and we need 6.0 to work in our environment - are there any tricks for conversion?

Re: If You Need an OVA...

mghazzi — Fri, 08 Feb 2019 20:00:54 GMT

if you look for my post above in this thread on 9-12-2018, I shared an OVA that was made for ESX 5.5 (HW Version 10) or higher. See this article for more detail on the VMWare Hardware Version compatibilty: https://kb.vmware.com/s/article/2007240

Re: If You Need an OVA...

dberber1 — Fri, 08 Feb 2019 20:04:41 GMT

Ahh - cool - overlooked it - thanks!

Re: If You Need an OVA..

sjanita — Wed, 03 Apr 2019 17:03:38 GMT

Update:

As of april 2019:

Do not use the OVA's in these links.

The Expedition team will be publishing an updated OVA with a new download link this week.

Re: If You Need an OVA..

kan3de — Mon, 15 Apr 2019 11:02:36 GMT

Any news here?

Re: If You Need an OVA..

sjanita — Mon, 15 Apr 2019 14:59:39 GMT

yes from the main site:

https://live.paloaltonetworks.com/t5/Expedition-Migration-Tool/ct-p/migration_tool

there is a link for "Get the tool OVA"