About rschunk

it is- 192.168.55.120 (default IP address for LITB Expedition).  Rich ... View more

Done and same issue.   expedition@pan-expedition : /PALogs $ ls -al total 16 drwxr-----   2 expedition www-data   4096 Dec 31 11:45 . drwxr-xr-x 24 root       root       4096 Dec 28 11:50 .. -rw-rw-r--   1 expedition expedition   944 Dec 31 13:00 pan-panos-vm50_traffic_2018_12_31_last_calendar_day.csv -rw-rw-r--   1 expedition expedition   17 Dec 31 12:55 ssh-export-test.txt   Dashboard is clean: no errors to remediate.  System looks good just cannot get files to show up under web interface to process.   Rich ... View more

There is only a single firewall involved.  SCP from the firewall does not work unless go into the CLI and change the /PALogs owner in Expedition to expedition.   Right now under Settings the Temporary Data Structure Folder is set to /opt/ml (this is the ova install default).  Do I need to change this to /PALogs files show up with thr web interface?   Thank you,  Rich ... View more

The file a sent directly by the firewall and this is the serial number configured in Expedition.  Panorama is not involved.   To get SCP to work I nee dto change oswer to expedition.  Files then transfer without an issue but the files never show up under M.Learning to process via the Web interface (files are on Expedition and visiable via SSH shell).   Rich ... View more

Folks-   In  my case I changed the owner so I could SCP the firewall logs to Expedition as I was getting a permissions failure.  All worked as expected and I can see the file on Expedition in the PALogs directory from my SSH shell.   However the file is never visible via the web interface so it cannot be processed.   I updated Expedition to the latest release but when I do this I get a reconnect mysql error even after editing the file to change reconnect to ON (see https://live.paloaltonetworks.com/t5/Expedition-Articles/Modifying-mysqli-reconnect-value/ta-p/219223).  Still do not see the file in the web interface.   Any ideas? ... View more

Do you know what I would modify to ge tthis to work? ... View more

Does anyone know the minimum VMware Workstation version required to import the Expedition VM?  I have 10.0.7.build-2844087 and Expedition fails to start as Workstaion does not recognize the VM type.   Thank you,  Rich ... View more

When I extract from the tar file all looks good.  When I try to "open" or "new virtual machine" under VM Workstation 10x it does not work.   "Open" sees the image as incompatible, "new vitual machine" does not see the Linux OS and requests this be added.   I never get the option to select "copied".   I have downlaoded the image from our Community Live site multiple times to be sure there is no corruption.   Rich ... View more

At the moment I can do a test URL and everything works with anoynomous as the setting in Minemeld.  What is not working is populating the EDLs.  I do not see any errors in the tail log, just no update to the firewall.   All EDLs are in a security rule and committed.    Prefer to see everything working with no anoynomous before trying true authentication again.   If you want to jump on a conference bridge we can look at this.  Just let me now.  Thanks,  Rich ... View more

Yes, the EDL is assigned to a security rule and committed in the firewall. ... View more

After a bit of testing this is what I have found:   - setting the Minemeld output processor tag to anonymous allows any access whether the EDL is configured with or w/o client authentication.   - setting the Minemeld output processor tag to any results in firewall EDL failure with  a URL access error. Client authentication in EDL profile is correct (there is not much to confgure...),  wget shows Minemeld rejecting the request with a 401.   - setting the Minemeld output processor to a specic tag mapped to a spefifc Feed user also fails.  Ciient authentication is corectly configured in the EDL object, wget shows Minemeld rejecting the request with a 401.   My testing is with a standalone Minemeld (since I can not make edits to the SE demo system) but the customer Minemeld is integrated into AutoFocus per my previous message.  I am having the customer change to anonymous for now but this is not what they want to do for production.   Rich ... View more

We are trying to get our firewalls to work with Minemeld using Autofocus to load into the firewall via EDLs both URLs and IP lists.  All is configured corretly on the AutoFocus Mimemeld including the username and password and tag for the feeder and this tag is also configured in the output processor.  We do not have an Admin user configured (just the Feed username and password).   The problem is the firewall in my opinion:   We have the Godaddy cert installed and imported as a 'CA' per the AutoFocus Minemeld techncial documentation (https://www.paloaltonetworks.com/documentation/autofocus/autofocus/autofocus_admin_guide/autofocus-apps/minemeld/use-autofocus-miners-with-the-palo-alto-networks-firewall).  We have the username and password corectedly installed with the cert in the EDL object.  However we get URL errors when hit the "test" button and cannot pull down the Minemeld list.  We tried re-configuring multipe times to make sure we did not mistype the username and password. We do not see any errors in the firewall system log.  Software is PAN-OS 8.0.5.   Any ideas?      Thank you,  Rich (rschunk@paloaltonetworks.com) ... View more