Introducing Expedition 2 Beta

[lychiang]

End of Life Announcement for Palo Alto Networks Expedition

We are excited to share some great news with you, as a valued user of Expedition functionalities. We are currently in the process of transferring the core functionalities of the tool into new products. This strategic move aligns with our commitment to meet the evolving needs of our customers and enhance our range of product offerings.

Starting from January 2025, Palo Alto Networks will no longer support the Expedition tool, including all versions of both Expedition1 and Expedition2 branches.

We believe this transition will bring even more value and improved capabilities to our users. For more details, please refer to Live Community site.

Dear valued customers,

We are excited to introduce the beta release of Expedition 2, a cutting-edge tool designed to facilitate firewall migration from various vendors and manage Palo Alto Networks firewalls/Panoramas configuration via API. Developed with a focus on automation, rich capabilities, and streamlined network management tasks, Expedition 2 aims to significantly enhance your network administration experience.

Expedition 2 offers numerous benefits, including automating firewall migration, simplifying security policy management, and enabling bulk operations across multiple devices.

While we are confident in Expedition 2's robust features and its ability to make network management more efficient, we acknowledge that this is a beta release. As such, there may be bugs and issues we need to resolve before the official launch. We encourage you to test the beta version of Expedition 2 and share your valuable feedback, which will help us improve the tool before its GA launch.

Please note that access to the beta version is restricted, and we kindly request you to fill out the online form available at the link below to receive access to the beta files:

Note: Updating google form link

https://forms.gle/wHukcW8QAvXXyxgXA

The form will request some information from you, which will help us understand your requirements and expectations better. Once we receive your response, we will provide you with the necessary access to the beta files.

We believe that your feedback will help us improve our product and make it more user-friendly. We encourage you to test the beta version thoroughly and provide us with your honest feedback.

If you encounter any issues or have any questions, please do not hesitate to contact us at fwmigrate@paloaltonetworks.com.

** UPDATE: 9th December 2024 **

PANser container tool support for Sonicwall migrations has been discontinued.

We appreciate your time and consideration and look forward to hearing from you soon.

Best regards,

Expedition Team

[mjj1587]

I have attempted to install this.  Unfortunately I am running into an issue where expedition-db container and expedition-parsers-db container keep restarting in a loop.  It is complaining saying "You need to specify one of MARIA_DB_ROOT_PASSWORD, MARIA_DB_ROOT_PASSWORD_HASH, MARIA_DB_ALLOW_EMPTY_ROOT_PASSWORD and MARIADB_RANDOM_ROOT_PASSWORD"

[lychiang]

Hi @mjj1587, have you modify the .env file before you run any command , you need to give a password to the mysql database variable , it's in the quick start up guide also in the Expedition 2 getting started guide. 

[mjj1587]

Yes, I did set the password to paloalto for the mysql database variable per the guide.

[mjj1587]

It almost seems like the .env file is not being read when I run "docker-compose up -d" because it gives me several warnings that the MYSQL_ROOT_PASSWORD is not set along with several other environment variables.  But they are 100% set in the env file. 

[lychiang]

Ok, I know the problem, your .env file has been changed to env file, you can open up the env file in vscode and save it to .env , and it will ask you do you want to save the file to hidden system file, and just say yes.  then re-run the docker-compose up -d again

[mjj1587]

Ahh thank you!  This solved the problem!

[sdogan]

Hi Team,

Have beta install files been released?

Regards,

[lychiang]

Hi @sdogan Yes, once you filled out the google form in the article, you should received access to the beta software , if you did not , please write email to fwmigrate@paloaltonetworks.com 

[Apadilla]

Hi,

I'm running the beta, what is the process to report issues ?

[lychiang]

Hi @Apadilla Thank you for being part of the beta test program, please report issues to fwmigrate@paloaltonetworks.com Thank you!

[Apadilla]

Thanks !!!

[Naser87]

fantastic tool, enjoyed using it, however I noticed that I could only view a maximum of 15 entries in the interface or Zone pages, even though alot more exist within the configuration file itself, ( 15 entries and 1 of 1 pages ).

[dpuigdomenec]

Thanks for feedback @Naser87 

Please could you send us an email to fwmigrate@paloaltonetworks.com with an screenshot of your view? Also witch type of interfaces does your configuration have?

Many thanks for participating in the beta program.

Best regards, 

[Naser87]

@dpuigdomenec Hello and thank you for your comment, I have sent the details to the specified Email, again thank you for all your immense efforts and cutting-edge innovations, they are much appreciated.

[lychiang]

@BartChamness New guide called "Expedition 2.x Getting Started" is in the google drive we shared with you.

[BartChamness]

Perfect, thank you 🙂

[Torrealba]

Can't find any more information. I got this installed up and running but for some reason it doesn't load the NGFW XML config. not even the sample pa220 that comes with the scripts.  There was one attempt that loaded but doesn't show any objects not networks, nada.

Anyone else running into this? I sent feedback to fwmigrate@paloaltonetworks.com.

[dpuigdomenec]

Hi @Torrealba 

Thanks for reaching out.

We will follow-up your case by email.

Best,

David

[S.Cantwell]

I would like to agree that I am struggling (like @Torrealba ) with getting the load config with any imported. panw.xml file... I see something happen, but then not clickable, nothing updates/move, and I cannot understand the migration flow. 

Instead of email, I would like to have a zoom meeting scheduled, so that the team is see/experience what we are doing.
Is this ever a possibility?

Thanks.

[lychiang]

@S.Cantwell Sure , my team is happy to assist with a session, please send an email to fwmigrate@paloaltonetworks.com directly . Thank you!

[DenzilS]

Hi all, my Retrieve Contents > Running Config jobs are stuck in pending state and my agent is idle. Andy ideas?

[dpuigdomenec]

Hi @DenzilS 

Thanks for reaching out.

Please could you send an email to fwmigrate@paloaltonetworks.com so we could provide you with some troubleshooting steps and as well we could schedule some call if needed.

Thanks in advance,

David

[S.Cantwell]

Hello

I am attempting to read and understand what I need to do for Panser deployment.
I am not a developer and the steps provided do not work, right the first command

Running the docker version:

Please advise next steps (preferred would be a zoom call, to go through the installation, as it will give devs a chance to see what is/isn't working, and also help the partner (me) get a working installation.

What does tomorrow morning look like for the team?

[dpuigdomenec]

Hi @S.Cantwell 

Thanks for reaching out by email as well as using the live portal.

We will follow-up your case by email.

Best regards,

David 

[rsolazhernan]

Hello @lychiang and team,

Could you let me know regarding Expedition 2 beta and according to best practices... which Ubuntu server version should be considered for the installation?

Thanks!

[lychiang]

@rsolazhernan Expedition 2 is container based, all you need is docker or docker desktop, then it can run on any platform. 

[Eric_Troldahl]

@lychiang 

1. Is the Beta still open?  I'm preparing to migrate over 100 Juniper lsys to Palo NGFW vsys over the next 6-12 months, and if the v2.x tool is nearing GA I'd rather start with the new tool instead of putting effort into v1.x.
2. Pretend for a minute that I am old school and don't know how to do a docker container.  Can I have my VM team spin up an Ubuntu Server VM and follow instructions to install the Docker structure on that to install v2?

[abarbany]

Hi @Eric_Troldahl regarding your questions.

About question 1: Expedition2 is still in Beta, but the parsers are the same for Expedition v1 and v2, so there is no problem to use Expedition2 for migrating. Moreover, the v2 is built as an API, meaning that you will be able to create scripts in case the migration steps are similar to all firewalls and automate the whole process. We have some example scripts written in Python using Jupyter Notebook on how to consume the API. This comes in the installation folder.

About question 2: You can install Docker either in your own machine or in a VM, just make sure the Docker Engine is supported for the platform. For Ubuntu there is no issues. Here you have a list of all supported platforms for Docker Engine: https://docs.docker.com/engine/install/ 

[Eric_Troldahl]

Follow-Up question - I have a team of 4 Firewall Analysts.  Should all 4 of us officially join the beta using the form so that we can all have access to the Google Drive, be on any distribution lists, etc.?  Or do you want the rest of the team to funnel questions and issues through me?  I'd prefer if they can be active even when I am on vacation/sick time.

[lychiang]

@Eric_Troldahl If you prefer 4 of you have direct access to google drive, then everyone of you need to sign up using your individual email. 

[JWeber14]

In running a migration from sonicwall I get an error saying I no panser available.  Is that a container I need to get?

 sonicwall (Require Panser container )

[abarbany]

Hello @JWeber14  Sonicwall parsers are only available using Panser, so you need to get the PANser container and provide some settings to Expedition in order to use it.

[dpuigdomenec]

Hi @JWeber14 , please fulfil and follow instructions on the below form to download PANser docker image:
https://forms.gle/zXGWh9cNgNaHSFBW6
Hope this helps,

David

[KlausNunes]

Hi, on the getting started guide_10172023 the images are not in there. Only the few first appears, the other are not showing.

[dpuigdomenec]

Hi @KlausNunes,

Thanks for reaching out.

Please download the latest version (updated yesterday) of the guide containing the images.

Thanks in advance,

David

[ncalderon]

Hello Guys!

Where can I download the latest release of Expedition 2.0 ?

[dpuigdomenec]

Hi @ncalderon,

Please fulfil the form https://forms.gle/wHukcW8QAvXXyxgXA

After doing so you will receive an automatic email with the link of a gdrive folder containing the documentation and the docker images.

If you do not receive it, please let us know using the email address fwmigrate@paloaltonetworks.com

Note that we recommend use Expedition1 in Production environments instead of Expedition2.

Hope this helps,

David