Chapter 3. Advanced Networking

3.1 Captive Portal

Learning Objectives

  • Configure VLANs
  • Configure captive portal

Prerequisites:

  • Setup Zones
  • Some interface configuration
  • Configuring VLANs on the GNS3 switch
  • Knowledge of previous labs

Scenario: Now let’s push for some advanced networking configurations. Sometimes you just have to push departments into their own VLANs for organization and compliance. Say we have a guest and employee network. We want to prevent communication between the two as much as possible. We would also want to implement some sort of login to access the internet for guests, much like hotels.

Main scenario
Figure 3.1: Main scenario
Table 3.1: Addressing Table
Device Configuration
PaloAlto-1 management: 192.168.0.1/24
Ethernet1/1: Trunking
Ethernet1/1.10: 10.10.10.1/24
Ethernet1/1.20: 20.20.20.1/24
Ethernet1/2: DHCP
VLAN-10 eth0: 10.10.10.10/24 GW: 10.10.10.1 DNS: 8.8.8.8
VLAN-20 eth0: 20.20.20.20/24 GW: 20.20.20.1 DNS: 8.8.8.8
Management eth0: 192.168.0.2/24
Switchy e0: Access mode, VLAN 10
e1: Access mode, VLAN 20
e7: dot1q, VLAN 1
Table 3.2: Zone Configuration
Zone Interface
VLAN10 Ethernet1/1.10
VLAN20 Ethernet1/1.20
Outside Ethernet1/2

Configure Sub Interfaces

Under Network > Interfaces. Click on ethernet1/1.

Ethernet 1/1 configuration
Figure 3.2: Ethernet 1/1 configuration

In this window, we just want to set the interface type to layer 3.

Set Interface type to Layer3
Figure 3.3: Set Interface type to Layer3

Then press OK.

Now while ethernet1/1 is still selected, click on add sub interface.

Add Sub interfaces
Figure 3.4: Add Sub interfaces

We want to add 2 sub-interfaces. Here is what you should configure:

Table 3.3: Sub Interface Configuration
Interface Configuration
Ethernet1/1.10 Interface Name: 10
Tag: 10
Config tab:
– Virtual Router: default
– Security Zone: VLAN10
IPv4:
– Type: Static
– IP: 10.10.10.1/24
Ethernet1/1.20 Interface Name: 20
Tag: 20
Config tab:
– Virtual Router: default
– Security Zone: VLAN20
IPv4:
– Type: Static
– IP: 20.20.20.1/24
Verify Sub interfaces
Figure 3.5: Verify Sub interfaces

Semi-Advanced Security Policies

Well, it’s not really advanced, but under Policies > Security, click Add.

Add a Security Policy
Figure 3.6: Add a Security Policy

We will be making a policy to allow VLAN10 and VLAN20 into the Outside zone. We can do this by adding multiple zones under the source zone.

Security Policy Rule - Source Zone
Figure 3.7: Security Policy Rule – Source Zone

Then click OK.

Semi-Advanced NAT Policies

Still not really advanced. But under Policies > NAT, click Add.

Add a NAT Policy
Figure 3.8: Add a NAT Policy

We want to make a Static NAT policy for the Internet connectivity. But under the Original Packet tab, we can select multiple zones.

Select the Source Zone in NAT Policy Rule
Figure 3.9: Select the Source Zone

Configure the rest for static NAT, then press OK.

SNAT Translated Packet Tab
Figure 3.10: SNAT Translated Packet Tab

Add a User

Under Device > Local User Database > Users. Click Add.

Add Users
Figure 3.11: Add Users

Create any user you want with a username and password. Here is an example:

Add an user Xav
Figure 3.12: Add a user xav

Then click OK.

Create an Authentication Profile

Under Device > Authentication Profile, click Add.

Add an Authentication Profile
Figure 3.13: Add an Authentication Profile

Under the Authentication tab, change the type to Local Database.

Select Local Database
Figure 3.14: Select Local Database

Under the Advanced tab, add your user.

Add user xav as Allow List
Figure 3.15: Add user xav as Allow List

Then press OK.

Configure the Captive Portal

Under Device, User Identification in the Authentication Portal Settings tab, click the settings icon.

Authentication Portal Settings
Figure 3.16: Authentication Portal Settings

Configure these settings:

Table 3.4: Authentication Portal Configuration
Parameter Value
Enable Authentication Portal Tick this box
Authentication Profile Select the one you created
Mode Transparent
Authentication Portal Settings - Select Transparent
Figure 3.17: Authentication Portal Settings – Select Transparent

Then press OK.

Under Network > Zones, click on the VLAN10 zone.

Select Vlan 10
Figure 3.18: Select Vlan 10

In this window, we just want to tick the Enable User Identification checkbox.

Enable User Identification
Figure 3.19: Enable User Identification

Then press OK.

Finally, under Policies > Authentication. Click Add.

Add an authentication Policy
Figure 3.20: Add an authentication Policy

Under the Source tab, add VLAN 10 in the source zone.

Add the Source Zone
Figure 3.21: Add the Source Zone

Under the Destination tab, add Outside in Destination Zone.

Add the Destination Zone
Figure 3.22: Add the Destination Zone

Under Actions, change the Authentication Enforcement setting, change it to default-web-form.

Select default-web-form
Figure 3.23: Select default-web-form

Then press OK.

Test VLANs and Captive Portal

On the VLAN-20 webterm, navigate to any website. If all was right, the desired website should appear.

Verify your configuration
Figure 3.24: Verify your configuration

On the VLAN-10 webterm, navigate to any website. If all was right, you should see a certificate error, accept this. Then you should see a login page.

Login Page
Figure 3.25: Login Page

Enter your credentials and log in. If all was successful, you should see the website appear.

Verify your configuration
Figure 3.26: Verify your configuration

License

Icon for the Creative Commons Attribution 4.0 International License

Palo Alto Firewall Copyright © 2023 by Hamid Talebi, Xavier Cawley is licensed under a Creative Commons Attribution 4.0 International License, except where otherwise noted.