If You Need an OVA...

[trice]

I created an OVA for my team and put it up here (Note, this isn't the official release now offered by PANW):

https://drive.google.com/open?id=1Z9GrCF8I_BZzpbEmEh6G75npo05_4G0c

Be sure to go Settings > M. Learning > and change the Expedition ML Address address to your VM's IP.

Then return to the Dashboad and Start the Agent.

[UPDATE 6.4.2019]

Updated the OS and Expedition to 1.1.23. 

There were a few new setting available with the upgrade, so a new directory /data was created and chowned to www-data.

There were resource alerts, so updated the /home/userSpace/environmentParameters.php file, so updated TotalCPUs to 2 and SparkRAM to 1592m. Moved image to S3. Note, image size has grown from allocated disk usage. I'll work on squeezing it down for the next release.

[UPDATE 2.22.2019]

I created a new OVA that is now at 1.1.6. All Ubuntu updates have been applied as well.

Permissions for the /datastore and /PALogs should work for all cases now.

VM Image was set to Version 10, so should work for VMware 5.5.

Made a change to /etc/default/grub and /etc/network/interfaces to always use eth0 instead of ensXXX.

Updated /home/expedition/update-expedition.sh to make upgrades easier.

SHA256 dad89cc3e2c031e70f548dab3bc96b84e0b2216593608dc09151159115463c65

[UPDATE 10.16.2018]

Updated Expedition to 1.0.106 and added all OS updates as well. 

[UPDATE 9.18.2018]

It's been upgraded to 1.0.104, but you'll likely need to update it once installed. So just:

sudo apt-get update

sudo apt-get install expedition-beta

...or just use the update-expedition.sh script I created in the home directory.

I also fixed a couple of other issues:

Fixed the /PALogs directory permissions and updated the Parquet Path in the Machine Learning section. This fixes the "Parquet Path" error on the Dashboard.

Changed the "mysqli.reconnect" value in /etc/php/7.0/cli/php.ini to "On" to fix the mysqli.reconnect error on the Dashboard.

[dgildelaig]

I would guess that you did not create the user expedition in your system.

[dgildelaig]

A new updated version of the script would control also the existence of the "expedition" user, and if it is not there, it will create it.

[snekkanti]

Hi,

Trying to install the latest expedition tool on vmx-12 (ESX version 6.0) and see Unsupported hardware family vmx-12 error. Where can i get the old .ova expedition image that supports vmx-12? 

We dont have option of upgrading vmx or ESX to higher 

Any suggestions on this would be helpful.

Thanks 

[dgildelaig]

Have you tried to use the installer on a clean Ubuntu Server 16.04 instead?

This method will create an Expedition instance on the Vm that you create, and it does not get affected by which version of HW did we use during OVA creation, as we do not need the OVA anymore.

Besides, you will get the latest packages installed just after the installation script completes..

[snekkanti]

Hi,

Thanks for the response. I am thinking to convert the .ova to .ovf by using workstation pro, will that work on esx 6.0?, if not i have to go for your suggestion. Do we have any doc on how to do that?

Thanks 

[dgildelaig]

You can check the following video:

https://www.youtube.com/watch?v=II_6dgnPn0U&feature=youtu.be

Let me know if you can visualize it.

[GregF1967]

What are the log in credentials?

[GregF1967]

I found the credentials to log on and I have Expedition up and running. Thank you so much for this.

[monizam]

Dear Sir,

I have installed the OVA file in my Vmware Workstation 15.

Can I get the CLI Login username and password ? 

[dgildelaig]

If you have used the installer or an official VM, the user is "expedition" and the password "paloalto".

[monizam]

Dear Sir,

Please find my VM Workstation screenshort below. I was used some other OVA files, but it's not given me the full PA features.

I have used your expedition verison, but it's completely diferent.  Can you suggest further.

[dgildelaig]

Most of the functionalities of Expedition are accessible via HTTPS.

From your current CLI view, you could check the IP that Expedition got via "ifconfig -a"

and later, access it via https://<IP>

[monizam]

Dear Sir,

Thanks for your reply.

I have followed your steps and I got the Expedition login page. I have tried to login with expedition" and the password "paloalto".

but seems to be it's not working.

COuld you please help me.

[dgildelaig]

For the web UI, the combination is admin\paloalto

[jlegarreta]

In case anyone is looking for a Docker container rather than a VM, see my post https://live.paloaltonetworks.com/t5/Expedition-Discussions/Docker-Container-for-Expedition/m-p/2907...