Expedition Documentation

[alestevez]

Here are all the Documents related to Expedition use and administrations

1. Installation Guide - Instructions to install Expedition 1 on an Ubuntu 20.04 Server and Transferring Projects between Expeditions
2. Hardening Expedition – Follow to secure your Instance.
3. Admin Guide – Describes the Admin section and provides advice on how to configure and properly setup.
4. User Guide  v1.1 (will be improved)
5. Log Analysis Feature Guide - (APP-ID Adoption, Rule Enrichment, and Machine Learning features)

[PktBlocker]

is there a way to do a password reset when you locked out of gui?

[justamoment]

@lychiang Hi - I'm just curious what your edits were to the OP as I don't see any differences and there's nothing in the article history.

Thanks!

[lychiang]

I basically corrected 64bit-amr to 64bit-amd for ubuntu 20.x 

[tchaney]

I was running into an issue installing the BPA 3.33.0 for ML and running the command provided would end with errors. after parsing the log I found the following:

ImportError: cannot import name 'sysconfig' from 'distutils' (/usr/lib/python3.7/distutils/__init__.py)

I researched and the issue was python 3.7 disutils was not installed which wasn't mentioned in the install for prereqs. I was able to resolve it by running the following:

sudo apt-get install python3.7-distutils

I hope this helps someone who's running into this issue.

[gurjarn]

Can we install Expedition tool on Suse linux 12.5? As ubuntu is not allowed in our environment.

[Brett.Hoshaw]

Just wanted to comment, that if you are trying to retrieve device configuration/panorama connected devices and you are logged in as "Admin" it may not work and there's no warning window or anything to let you know there's an issue.  I was able to find this log via CLI:

{"success":false,"message":"Type [op] not authorized for user role."}

Which is when I decide to logout of "Admin" and login as an actual admin/superuser account where the operation was successful.  This log doesn't exist in the GUI as far as I could tell.

[kandaspr]

We installed expedition 1.2.50 on ubuntu 20.04 as per installation guide but we are stuck at login page with message "authenticating please wait". We did re-installation couple of times and tried following commands as well but no luck. Can anyone please help me on this.

sudo apt-get update
sudo apt-get install expedition-beta

sudo apt-get -y -f install
sudo apt-get autoremove

Thanks

[lychiang]

@kandaspr Can you please perform below steps for troubleshooting purposes:

Please follow the steps below to troubleshoot, after each of the steps , try to login to GUI , if you are able to login , you do not need to continue the remaining steps. 

1. Delete the cookies on your browser , and refresh the browser 

2. login to CLI to verify mysql service is up and running by issue below command:

sudo service mysql status 

You should see mysql service is "active(running) , if not , trying to restart the mysql by issue below command:

sudo service mysql restart

If you encounter an error, pelase follow the instructions to view more details on why mysql is not started.

3. Follow the below article to remove tc.log:

https://live.paloaltonetworks.com/t5/expedition-discussions/incorrect-user-or-password-when-logging-...

4. Verify if all php package are 7.0 by issuing below command:

apt list --installed | grep php 

If there are versions other than 7.0 installed, you will need to re-install the ubuntu VM from scratch.

If all those steps does not help, please issue below commands to remove expedition and re-ran the installation from scratch :

$sudo apt-get remove expedition-beta

[kandaspr]

Hi Lychiang,

Thank you for the update.

I performed above steps but still stuck at login page with same error. I also run the following command and restored admin password but no luck.

sudo php /var/www/html/OS/startup/restore/restoreAdmin.php

Reinstalled from scratch again and noticed many scirpts failed during installation and fixed few of them manually, but we unable to find php7.0 and installed php7.4,

Note, selecting 'php-radius' instead of 'php7.4-radius'
E: Unable to locate package php7.4-mcrypt
E: Couldn't find any package by glob 'php7.4-mcrypt'
E: Couldn't find any package by regex 'php7.4-mcrypt'

Cannot add PPA: 'ppa:~adiscon/ubuntu/v8-stable'

E: Unable to locate package perl-5.30
E: Couldn't find any package by glob 'perl-5.30'
E: Couldn't find any package by regex 'perl-5.30

Following are the users, i could see but still login is stuck.

MariaDB [(none)]> select host,user from mysql.user;
+-----------+------------+
| host | user |
+-----------+------------+
| % | admin |
| % | expedition |
| localhost | root |
+-----------+------------+

[lychiang]

@kandaspr Expedition only works on php 7.0 , so please re-install the ubuntu server 20.04.x and please do not perform any upgrade on the application, first thing to do is run the expedition installation script. 

[Al-Amin]

Hi teams,

I would like to install expedition tools on ubuntu 20.04. But  I did not found any documentation. So can you please share a document for install the expedition on ubuntu 20.04. 

I tried with 16.04 script but it is not working. 

Regards

Al Amin

[dpuigdomenec]

Hi @Al-Amin 

Thanks for reaching out.

Below links will point you to the required installer and installation guide.

• Installer: https://conversionupdates.paloaltonetworks.com/expedition1_Installer_latest.tgz
• Guides: https://live.paloaltonetworks.com/t5/expedition-articles/expedition-documentation/ta-p/215619

Take into consideration the VM need to have internet access to following sites (including subdomains) or the script will fail to install required dependencies.

• https://conversionupdates.paloaltonetworks.com
• http://us.archive.ubuntu.com
• http://ppa.launchpad.net
• https://www.rabbitmq.com
• http://launchpad.net
• https://launchpad.net
• https://files.pythonhosted.org

Let us know if you need anything else,

Best

[vishalrsshah]

Hi all

Im migrating from cisco asa to palo alto, perform all steps however unable to do final config merge and download. It states on pending state and when i refresh the page it logout. Upon relogin when i check status it shows ready but loading the backup on palo alto does not contain converted file. PFA 

[lychiang]

Hi @vishalrsshah, it seems like your agent might not be running. Can you please check the dashboard to ensure that the agent is running? If it has stopped, you can click "start" to restart the agent.

Regarding the merged objects from ciscoconfig, please move all items under the network folder from the left side to the network folder on the right side. Similarly, for vsys1, move all items under vsys1 to the corresponding right side folder."

[vishalrsshah]

Agent is running and also i have move items from left side to right side. Still unable to merge config and download final update

[vishalrsshah]

Hi All,

I have converted my Cisco Asa config to Palo Alto, however there's only 10 zone i can find in converted xml file. Is it any limitation on Expedition tool 

[lychiang]

For ciscoasa migration, zone is created based on interfaces , please double check your original cisco config to see how many interfaces are there.  If you need more zones, you can manually created zone in Expedition , and assign interfaces to it.