Most production deployments use VMware ESXi. Here is the precise installation method.
Before beginning, ensure you have:
Within an hour, what would have taken weeks of manual translation became a staged migration plan. Alex closed the laptop, grabbed a coffee, and whispered, “That’s why you always read the OVA install guide first.”
Moral: A well-downloaded OVA saves nine.
If you are looking to set up the Palo Alto Networks Expedition Migration Tool, it is important to note that the software is no longer distributed as a standalone OVA file for direct import into VMware. Instead, the modern installation method involves provisioning a base Ubuntu Server and running a specialized installer script. Key Prerequisites
Operating System: Ubuntu Server 20.04 LTS (64-bit AMD) is the currently supported platform for Expedition 1.x.
Hardware Resources: At least 8GB of RAM and 40GB of disk space are recommended for basic migrations.
Connectivity: The server must have internet access to download dependencies like MariaDB, Apache, and RabbitMQ during the installation process. Step-by-Step Installation Guide 1. Prepare the Base VM
Since a pre-built OVA is unavailable, you must first create a virtual machine manually: Download the Ubuntu 20.04 LTS ISO from the official site.
Create a new VM in your hypervisor (VMware, VirtualBox, etc.) using the downloaded ISO.
During setup, create a user named expedition with the password paloalto (this is the community standard for troubleshooting simplicity). 2. Download and Run the Installer Script
Once your Ubuntu server is running and you have SSH access, use the following commands to install the tool: download palo alto expedition ova install
# Navigate to the temporary directory cd /tmp # Download the latest installer script sudo wget https://conversionupdates.paloaltonetworks.com/expedition1_Installer_latest.tgz # Extract and run the installer tar -zxvf expedition1_Installer_latest.tgz sudo ./initSetup.sh Use code with caution. Copied to clipboard
The script will automatically handle the installation of the web server and database components. 3. Access the Expedition Web Interface
After the script finishes, you can access the tool via your web browser: URL: https:// Default Credentials: Username: admin Password: paloalto Important: Support and Security Status
End of Life: Palo Alto Networks officially ended support for Expedition in January 2025.
Security Risk: Because the tool is no longer receiving security patches, it should only be used in a secure, isolated management network and never exposed to the public internet. Expedition Installation Guide - Palo Alto Networks
Complete Guide: Downloading and Installing Palo Alto Expedition
Palo Alto Expedition is the primary migration tool designed to help security teams transition configurations from third-party vendors (like Cisco or Checkpoint) to Palo Alto Networks next-generation firewalls. While older versions were distributed as pre-packaged OVA (Open Virtual Appliance) files for quick deployment on VMware, the modern installation method has shifted toward a more flexible script-based approach on a standard Linux server. Understanding the "OVA" vs. "Script" Installation
For those searching for an Expedition OVA, it is important to note that Palo Alto Networks has largely moved away from providing a direct OVA download for the newest versions.
Legacy Method: Previously, you could download a "Legacy Expedition OVA" and import it directly into your hypervisor.
Current Method: The tool is now delivered as an installation script that you run on a fresh Ubuntu 20.04 LTS (64-bit AMD) server. Phase 1: Prerequisites and System Requirements
Before beginning the installation, ensure your host environment meets the recommended minimum specifications for optimal performance, especially if you plan to use machine learning features for log analysis. Minimum Requirement Operating System Ubuntu Server 20.04 LTS (Do not use 22.x) CPU 4-8 vCPUs (depending on project size) Memory 8GB - 16GB RAM Storage 40GB - 100GB (SSD preferred for log analytics) Connectivity Internet access for script downloads and package updates Phase 2: Installing Palo Alto Expedition (Step-by-Step) Most production deployments use VMware ESXi
If you cannot find a current OVA, follow these steps to build your Expedition instance manually. 1. Deploy the Base Ubuntu Server
Download the Ubuntu 20.04.x LTS ISO and create a new virtual machine in your hypervisor (VMware Workstation/ESXi, VirtualBox, etc.).
During installation, create a user named expedition with a password like paloalto (you can change this later).
Ensure you select Install OpenSSH server to allow remote terminal access. 2. Run the Expedition Installer Script
Once the server is running and you have SSH access, download and execute the Expedition installer script from the Palo Alto LIVEcommunity.
# Update your package list sudo apt-get update # Download the installer wget https://conversionupdates.paloaltonetworks.com/expeditionInstaller.tgz # Extract and run the script tar -zxvf expeditionInstaller.tgz sudo ./install.sh Use code with caution. 3. Verify the Installation
After the script finishes, the Expedition web service should be active. Access the GUI by navigating to https:// in a web browser. Default Username: admin Default Password: paloalto Phase 3: Post-Installation & Security
Because Expedition contains sensitive configuration data and API keys, it should be treated as a high-security asset. Expedition | Palo Alto Networks - LIVEcommunity
Palo Alto Networks has deprecated the official standalone OVA Expedition . The current supported method is to Ubuntu Server 20.04 LTS (64-bit AMD) and run an installer script to deploy the application Palo Alto Networks LIVEcommunity Current Installation Steps Deploy Ubuntu VM : Download the Ubuntu 20.04 LTS Server ISO and install it on your hypervisor. Download Installer : On the Ubuntu VM, download the Expedition installer script Run Script
: Unpack and execute the script to install the Expedition application and its dependencies (MariaDB, Apache, etc.). tar -zxvf expedition1_Installer_latest.tgz Palo Alto Networks LIVEcommunity System Requirements
To ensure stability, provision your VM with the following minimum resources: Palo Alto Networks LIVEcommunity : 8 Cores (especially for 6+ firewalls) : 16–32 GB : 500 GB (SSD recommended) Legacy & Community OVA Options Within an hour, what would have taken weeks
If you specifically need an OVA file for a lab environment, there are unofficial or legacy community-provided versions: Community OVA
: A popular community-maintained OVA is available through the LIVEcommunity discussions , though it may be outdated. Support Portal
: Official software updates for registered devices can be found on the Palo Alto Customer Support Portal (CSP)
, though Expedition-specific OVAs are no longer the primary delivery method. Palo Alto Networks LIVEcommunity
Need OVA file for Expedition to install on VMware. Please help!
Downloading and Installing Palo Alto Expedition OVA
Palo Alto Expedition is a migration tool that helps you transition from your existing firewall configuration to a new Palo Alto Networks firewall. To get started, you'll need to download and install the Expedition OVA (Open Virtual Appliance) file.
Step-by-Step Instructions:
Prerequisites and Considerations:
Additional Resources:
By following these steps and resources, you should be able to successfully download and install the Palo Alto Expedition OVA file, and begin your migration journey. If you encounter any issues, don't hesitate to reach out to Palo Alto Networks support for assistance!
| Symptom | Likely Cause | Solution |
|---------|--------------|----------|
| OVA import fails "Invalid OVF" | Corrupted download | Re-download the OVA and verify the checksum. |
| VM boots to black screen | Insufficient RAM | Allocate at least 4 GB RAM. |
| Cannot reach web UI on port 443 | Firewall or Expedition service down | From console: sudo systemctl status expedition; if stopped, sudo systemctl start expedition. |
| DHCP IP changes after reboot | No static IP configured | Follow Part 3 to set a static IP via netplan. |
| "Login failed" repeatedly | Forgotten password | From console: sudo passwd expedition to reset. |
| "502 Bad Gateway" on web UI | PostgreSQL not running | Console: sudo systemctl restart postgresql and sudo systemctl restart expedition. |
The following steps are specific to VMware ESXi using the vSphere Client, but the process is similar for VMware Workstation or Fusion.