Palo Alto Firewall

OTB327-01-COVER-Palo-Alto-Firewall-Practical-Guidance-and-Hands-On-Labs

acheveldave — Wed, 29 Nov 2023 00:03:10 +0000

Example Topology

acheveldave — Wed, 29 Nov 2023 00:03:12 +0000

1

acheveldave — Wed, 29 Nov 2023 00:03:12 +0000

Palo1

acheveldave — Wed, 29 Nov 2023 00:03:12 +0000

Palo2

acheveldave — Wed, 29 Nov 2023 00:03:13 +0000

2022-03-16-19-46-28-image

acheveldave — Wed, 29 Nov 2023 00:03:13 +0000

2022-03-16-19-50-52-image

acheveldave — Wed, 29 Nov 2023 00:03:13 +0000

2022-03-16-19-52-12-image

acheveldave — Wed, 29 Nov 2023 00:03:14 +0000

Palo3

acheveldave — Wed, 29 Nov 2023 00:03:15 +0000

2022-03-16-19-54-15-image

acheveldave — Wed, 29 Nov 2023 00:03:15 +0000

2022-03-16-19-55-10-image

acheveldave — Wed, 29 Nov 2023 00:03:16 +0000

Palo4

acheveldave — Wed, 29 Nov 2023 00:03:17 +0000

Palo5

acheveldave — Wed, 29 Nov 2023 00:03:17 +0000

Palo6jpg

acheveldave — Wed, 29 Nov 2023 00:03:17 +0000

Palo7

acheveldave — Wed, 29 Nov 2023 00:03:18 +0000

Palo8

acheveldave — Wed, 29 Nov 2023 00:03:18 +0000

Palo9

acheveldave — Wed, 29 Nov 2023 00:03:18 +0000

Palo10

acheveldave — Wed, 29 Nov 2023 00:03:19 +0000

Palo11

acheveldave — Wed, 29 Nov 2023 00:03:19 +0000

Palo12

acheveldave — Wed, 29 Nov 2023 00:03:19 +0000

Palo13

acheveldave — Wed, 29 Nov 2023 00:03:19 +0000

Palo14

acheveldave — Wed, 29 Nov 2023 00:03:20 +0000

topology2

acheveldave — Wed, 29 Nov 2023 00:03:21 +0000

DHCP1

acheveldave — Wed, 29 Nov 2023 00:03:21 +0000

DHCP2

acheveldave — Wed, 29 Nov 2023 00:03:21 +0000

1

acheveldave — Wed, 29 Nov 2023 00:03:22 +0000

DHCP3

acheveldave — Wed, 29 Nov 2023 00:03:23 +0000

DHCP4

acheveldave — Wed, 29 Nov 2023 00:03:23 +0000

DHCP5

acheveldave — Wed, 29 Nov 2023 00:03:24 +0000

DHCP6

acheveldave — Wed, 29 Nov 2023 00:03:24 +0000

DHCP7

acheveldave — Wed, 29 Nov 2023 00:03:25 +0000

DHCP8

acheveldave — Wed, 29 Nov 2023 00:03:25 +0000

DHCP9

acheveldave — Wed, 29 Nov 2023 00:03:25 +0000

2022-03-18-17-56-33-image

acheveldave — Wed, 29 Nov 2023 00:03:26 +0000

DHCP10

acheveldave — Wed, 29 Nov 2023 00:03:27 +0000

DHCP11

acheveldave — Wed, 29 Nov 2023 00:03:27 +0000

DHCP12

acheveldave — Wed, 29 Nov 2023 00:03:27 +0000

DHCP13

acheveldave — Wed, 29 Nov 2023 00:03:27 +0000

DHCP14

acheveldave — Wed, 29 Nov 2023 00:03:28 +0000

DHCP15

acheveldave — Wed, 29 Nov 2023 00:03:28 +0000

DHCP16

acheveldave — Wed, 29 Nov 2023 00:03:29 +0000

DHCP17

acheveldave — Wed, 29 Nov 2023 00:03:29 +0000

DHCP18

acheveldave — Wed, 29 Nov 2023 00:03:30 +0000

DHCP19

acheveldave — Wed, 29 Nov 2023 00:03:30 +0000

DHCP20

acheveldave — Wed, 29 Nov 2023 00:03:31 +0000

DHCP21

acheveldave — Wed, 29 Nov 2023 00:03:31 +0000

DHCP22

acheveldave — Wed, 29 Nov 2023 00:03:32 +0000

DHCP23

acheveldave — Wed, 29 Nov 2023 00:03:32 +0000

2022-03-18-19-17-28-image

acheveldave — Wed, 29 Nov 2023 00:03:33 +0000

2022-03-18-19-18-05-image

acheveldave — Wed, 29 Nov 2023 00:03:33 +0000

1

acheveldave — Wed, 29 Nov 2023 00:03:34 +0000

2

acheveldave — Wed, 29 Nov 2023 00:03:35 +0000

3

acheveldave — Wed, 29 Nov 2023 00:03:35 +0000

4

acheveldave — Wed, 29 Nov 2023 00:03:36 +0000

5

acheveldave — Wed, 29 Nov 2023 00:03:36 +0000

6

acheveldave — Wed, 29 Nov 2023 00:03:37 +0000

2022-04-18-01-36-27-image

acheveldave — Wed, 29 Nov 2023 00:03:38 +0000

NAT1

acheveldave — Wed, 29 Nov 2023 00:03:38 +0000

2022-04-18-01-27-04-image

acheveldave — Wed, 29 Nov 2023 00:03:39 +0000

2022-04-18-01-30-12-image

acheveldave — Wed, 29 Nov 2023 00:03:39 +0000

NAT2

acheveldave — Wed, 29 Nov 2023 00:03:40 +0000

2022-04-18-01-42-34-image

acheveldave — Wed, 29 Nov 2023 00:03:41 +0000

2022-04-18-01-44-24-image

acheveldave — Wed, 29 Nov 2023 00:03:42 +0000

NAT3

acheveldave — Wed, 29 Nov 2023 00:03:42 +0000

2022-04-18-01-46-15-image

acheveldave — Wed, 29 Nov 2023 00:03:43 +0000

2022-04-18-01-46-46-image

acheveldave — Wed, 29 Nov 2023 00:03:44 +0000

2022-04-18-01-49-08-image

acheveldave — Wed, 29 Nov 2023 00:03:44 +0000

2022-04-19-09-29-49-image

acheveldave — Wed, 29 Nov 2023 00:03:45 +0000

Sec1

acheveldave — Wed, 29 Nov 2023 00:03:45 +0000

2022-04-19-09-46-30-image

acheveldave — Wed, 29 Nov 2023 00:03:46 +0000

2022-04-19-09-48-12-image

acheveldave — Wed, 29 Nov 2023 00:03:47 +0000

2022-04-19-09-49-45-image

acheveldave — Wed, 29 Nov 2023 00:03:50 +0000

2022-04-23-00-07-28-image

acheveldave — Wed, 29 Nov 2023 00:03:51 +0000

2022-04-23-00-21-06-image

acheveldave — Wed, 29 Nov 2023 00:03:52 +0000

1

acheveldave — Wed, 29 Nov 2023 00:03:53 +0000

2022-04-23-00-33-28-image

acheveldave — Wed, 29 Nov 2023 00:03:53 +0000

2022-04-23-00-33-53-image

acheveldave — Wed, 29 Nov 2023 00:03:54 +0000

2

acheveldave — Wed, 29 Nov 2023 00:03:55 +0000

Sec2

acheveldave — Wed, 29 Nov 2023 00:03:55 +0000

Sec3

acheveldave — Wed, 29 Nov 2023 00:03:56 +0000

2022-04-23-00-38-58-image

acheveldave — Wed, 29 Nov 2023 00:03:56 +0000

2022-04-23-00-41-38-image

acheveldave — Wed, 29 Nov 2023 00:03:57 +0000

2022-04-23-00-42-15-image

acheveldave — Wed, 29 Nov 2023 00:03:58 +0000

2022-04-23-00-44-16-image

acheveldave — Wed, 29 Nov 2023 00:03:59 +0000

2022-04-23-00-56-14-image

acheveldave — Wed, 29 Nov 2023 00:04:02 +0000

2022-04-23-00-57-05-image

acheveldave — Wed, 29 Nov 2023 00:04:06 +0000

2022-04-23-00-57-43-image

acheveldave — Wed, 29 Nov 2023 00:04:11 +0000

Sec4

acheveldave — Wed, 29 Nov 2023 00:04:14 +0000

2022-04-23-01-01-02-image

acheveldave — Wed, 29 Nov 2023 00:04:15 +0000

2022-04-23-01-05-43-image

acheveldave — Wed, 29 Nov 2023 00:04:19 +0000

Sec5

acheveldave — Wed, 29 Nov 2023 00:04:20 +0000

Sec6.2

acheveldave — Wed, 29 Nov 2023 00:04:20 +0000

Sec7

acheveldave — Wed, 29 Nov 2023 00:04:21 +0000

2022-04-23-01-13-35-image

acheveldave — Wed, 29 Nov 2023 00:04:21 +0000

2022-04-23-01-14-15-image

acheveldave — Wed, 29 Nov 2023 00:04:22 +0000

2022-04-23-01-17-49-image

acheveldave — Wed, 29 Nov 2023 00:04:23 +0000

Sec8

acheveldave — Wed, 29 Nov 2023 00:04:24 +0000

2022-04-23-01-18-37-image

acheveldave — Wed, 29 Nov 2023 00:04:24 +0000

2022-04-23-01-20-40-image

acheveldave — Wed, 29 Nov 2023 00:04:25 +0000

2022-04-23-01-23-19-image

acheveldave — Wed, 29 Nov 2023 00:04:26 +0000

2022-04-23-01-24-19-image

acheveldave — Wed, 29 Nov 2023 00:04:26 +0000

2022-04-23-01-25-24-image

acheveldave — Wed, 29 Nov 2023 00:04:27 +0000

Sec9

acheveldave — Wed, 29 Nov 2023 00:04:28 +0000

Sec10

acheveldave — Wed, 29 Nov 2023 00:04:28 +0000

2022-04-23-01-54-06-image

acheveldave — Wed, 29 Nov 2023 00:04:29 +0000

2022-04-23-01-54-49-image

acheveldave — Wed, 29 Nov 2023 00:04:33 +0000

2022-04-23-12-21-06-image

acheveldave — Wed, 29 Nov 2023 00:04:34 +0000

Vir1

acheveldave — Wed, 29 Nov 2023 00:04:34 +0000

Vir2

acheveldave — Wed, 29 Nov 2023 00:04:35 +0000

Vir3

acheveldave — Wed, 29 Nov 2023 00:04:36 +0000

Vir4

acheveldave — Wed, 29 Nov 2023 00:04:36 +0000

Vir5

acheveldave — Wed, 29 Nov 2023 00:04:37 +0000

2022-04-23-12-47-38-image

acheveldave — Wed, 29 Nov 2023 00:04:37 +0000

Vir6

acheveldave — Wed, 29 Nov 2023 00:04:38 +0000

2022-04-23-12-53-46-image

acheveldave — Wed, 29 Nov 2023 00:04:39 +0000

Vir7

acheveldave — Wed, 29 Nov 2023 00:04:39 +0000

2022-04-23-13-01-44-image

acheveldave — Wed, 29 Nov 2023 00:04:40 +0000

Vir8

acheveldave — Wed, 29 Nov 2023 00:04:41 +0000

2022-04-23-13-05-54-image

acheveldave — Wed, 29 Nov 2023 00:04:41 +0000

Vir9

acheveldave — Wed, 29 Nov 2023 00:04:42 +0000

2022-04-23-13-09-01-image

acheveldave — Wed, 29 Nov 2023 00:04:43 +0000

2022-04-23-13-09-42-image

acheveldave — Wed, 29 Nov 2023 00:04:43 +0000

usethisone

acheveldave — Wed, 29 Nov 2023 00:04:44 +0000

VLAN1

acheveldave — Wed, 29 Nov 2023 00:04:45 +0000

VLAN2

acheveldave — Wed, 29 Nov 2023 00:04:45 +0000

VLAN3

acheveldave — Wed, 29 Nov 2023 00:04:46 +0000

VLAN4

acheveldave — Wed, 29 Nov 2023 00:04:46 +0000

VLAN5

acheveldave — Wed, 29 Nov 2023 00:04:47 +0000

VLAN6

acheveldave — Wed, 29 Nov 2023 00:04:47 +0000

1

acheveldave — Wed, 29 Nov 2023 00:04:48 +0000

VLAN7

acheveldave — Wed, 29 Nov 2023 00:04:48 +0000

2

acheveldave — Wed, 29 Nov 2023 00:04:49 +0000

VLAN8

acheveldave — Wed, 29 Nov 2023 00:04:49 +0000

2022-04-23-14-22-00-image

acheveldave — Wed, 29 Nov 2023 00:04:50 +0000

VLAN9

acheveldave — Wed, 29 Nov 2023 00:04:51 +0000

VLAN10

acheveldave — Wed, 29 Nov 2023 00:04:51 +0000

2022-04-23-14-27-00-image

acheveldave — Wed, 29 Nov 2023 00:04:52 +0000

VLAN11

acheveldave — Wed, 29 Nov 2023 00:04:52 +0000

2022-04-23-14-30-11-image

acheveldave — Wed, 29 Nov 2023 00:04:53 +0000

VLAN12

acheveldave — Wed, 29 Nov 2023 00:04:54 +0000

VLAN13

acheveldave — Wed, 29 Nov 2023 00:04:54 +0000

VLAN14

acheveldave — Wed, 29 Nov 2023 00:04:55 +0000

VLAN15

acheveldave — Wed, 29 Nov 2023 00:04:55 +0000

VLAN16

acheveldave — Wed, 29 Nov 2023 00:04:56 +0000

VLAN17

acheveldave — Wed, 29 Nov 2023 00:04:57 +0000

2022-04-23-14-55-20-image

acheveldave — Wed, 29 Nov 2023 00:04:57 +0000

2022-04-23-14-56-58-image

acheveldave — Wed, 29 Nov 2023 00:04:58 +0000

2022-04-23-14-57-51-image

acheveldave — Wed, 29 Nov 2023 00:04:59 +0000

2022-04-24-21-16-57-image

acheveldave — Wed, 29 Nov 2023 00:05:00 +0000

Rem1

acheveldave — Wed, 29 Nov 2023 00:05:00 +0000

Rem2

acheveldave — Wed, 29 Nov 2023 00:05:01 +0000

Rem3

acheveldave — Wed, 29 Nov 2023 00:05:01 +0000

Rem4

acheveldave — Wed, 29 Nov 2023 00:05:02 +0000

Rem5

acheveldave — Wed, 29 Nov 2023 00:05:03 +0000

2022-04-25-00-46-16-image

acheveldave — Wed, 29 Nov 2023 00:05:03 +0000

Rem6

acheveldave — Wed, 29 Nov 2023 00:05:04 +0000

2022-04-25-00-52-33-image

acheveldave — Wed, 29 Nov 2023 00:05:05 +0000

Rem7

acheveldave — Wed, 29 Nov 2023 00:05:05 +0000

Rem8

acheveldave — Wed, 29 Nov 2023 00:05:06 +0000

Rem9

acheveldave — Wed, 29 Nov 2023 00:05:07 +0000

Rem10

acheveldave — Wed, 29 Nov 2023 00:05:07 +0000

Rem11

acheveldave — Wed, 29 Nov 2023 00:05:08 +0000

Rem12

acheveldave — Wed, 29 Nov 2023 00:05:08 +0000

Rem13a

acheveldave — Wed, 29 Nov 2023 00:05:09 +0000

2022-04-25-01-26-39-image

acheveldave — Wed, 29 Nov 2023 00:05:10 +0000

Rem14

acheveldave — Wed, 29 Nov 2023 00:05:11 +0000

2022-04-25-01-35-57-image

acheveldave — Wed, 29 Nov 2023 00:05:11 +0000

Rem15

acheveldave — Wed, 29 Nov 2023 00:05:12 +0000

Rem16

acheveldave — Wed, 29 Nov 2023 00:05:13 +0000

Rem17

acheveldave — Wed, 29 Nov 2023 00:05:13 +0000

Rem18

acheveldave — Wed, 29 Nov 2023 00:05:14 +0000

Rem19

acheveldave — Wed, 29 Nov 2023 00:05:14 +0000

Rem20

acheveldave — Wed, 29 Nov 2023 00:05:15 +0000

2022-04-25-01-45-47-image

acheveldave — Wed, 29 Nov 2023 00:05:16 +0000

2022-04-25-01-50-02-image

acheveldave — Wed, 29 Nov 2023 00:05:20 +0000

2022-04-25-02-05-17-image

acheveldave — Wed, 29 Nov 2023 00:05:21 +0000

S1

acheveldave — Wed, 29 Nov 2023 00:05:21 +0000

S2

acheveldave — Wed, 29 Nov 2023 00:05:22 +0000

S3

acheveldave — Wed, 29 Nov 2023 00:05:22 +0000

S4

acheveldave — Wed, 29 Nov 2023 00:05:23 +0000

S5

acheveldave — Wed, 29 Nov 2023 00:05:23 +0000

S6

acheveldave — Wed, 29 Nov 2023 00:05:24 +0000

S7

acheveldave — Wed, 29 Nov 2023 00:05:25 +0000

S8

acheveldave — Wed, 29 Nov 2023 00:05:25 +0000

2022-04-25-02-52-22-image

acheveldave — Wed, 29 Nov 2023 00:05:26 +0000

2022-04-25-02-54-25-image

acheveldave — Wed, 29 Nov 2023 00:05:27 +0000

ScreenShot00176

acheveldave — Wed, 29 Nov 2023 00:05:28 +0000

ScreenShot00131

acheveldave — Wed, 29 Nov 2023 00:05:28 +0000

ScreenShot00132

acheveldave — Wed, 29 Nov 2023 00:05:28 +0000

ScreenShot00133

acheveldave — Wed, 29 Nov 2023 00:05:29 +0000

ScreenShot00134

acheveldave — Wed, 29 Nov 2023 00:05:29 +0000

ScreenShot00135

acheveldave — Wed, 29 Nov 2023 00:05:30 +0000

ScreenShot00085-1

acheveldave — Wed, 29 Nov 2023 00:05:30 +0000

ScreenShot00086-1

acheveldave — Wed, 29 Nov 2023 00:05:31 +0000

ScreenShot00136

acheveldave — Wed, 29 Nov 2023 00:05:31 +0000

ScreenShot00137

acheveldave — Wed, 29 Nov 2023 00:05:32 +0000

ScreenShot00138

acheveldave — Wed, 29 Nov 2023 00:05:32 +0000

ScreenShot00139

acheveldave — Wed, 29 Nov 2023 00:05:32 +0000

ScreenShot00140

acheveldave — Wed, 29 Nov 2023 00:05:33 +0000

ScreenShot00141

acheveldave — Wed, 29 Nov 2023 00:05:33 +0000

ScreenShot00150

acheveldave — Wed, 29 Nov 2023 00:05:34 +0000

ScreenShot00151

acheveldave — Wed, 29 Nov 2023 00:05:34 +0000

ScreenShot00152

acheveldave — Wed, 29 Nov 2023 00:05:34 +0000

ScreenShot00153

acheveldave — Wed, 29 Nov 2023 00:05:35 +0000

ScreenShot00154

acheveldave — Wed, 29 Nov 2023 00:05:35 +0000

ScreenShot00155

acheveldave — Wed, 29 Nov 2023 00:05:35 +0000

ScreenShot00156

acheveldave — Wed, 29 Nov 2023 00:05:36 +0000

ScreenShot00142

acheveldave — Wed, 29 Nov 2023 00:05:36 +0000

ScreenShot00143

acheveldave — Wed, 29 Nov 2023 00:05:36 +0000

ScreenShot00144

acheveldave — Wed, 29 Nov 2023 00:05:37 +0000

ScreenShot00145

acheveldave — Wed, 29 Nov 2023 00:05:37 +0000

ScreenShot00146

acheveldave — Wed, 29 Nov 2023 00:05:37 +0000

ScreenShot00147

acheveldave — Wed, 29 Nov 2023 00:05:37 +0000

ScreenShot00169

acheveldave — Wed, 29 Nov 2023 00:05:38 +0000

ScreenShot00170

acheveldave — Wed, 29 Nov 2023 00:05:38 +0000

ScreenShot00177

acheveldave — Wed, 29 Nov 2023 00:05:38 +0000

ScreenShot00178

acheveldave — Wed, 29 Nov 2023 00:05:38 +0000

ScreenShot00157

acheveldave — Wed, 29 Nov 2023 00:05:39 +0000

ScreenShot00158

acheveldave — Wed, 29 Nov 2023 00:05:39 +0000

ScreenShot00159

acheveldave — Wed, 29 Nov 2023 00:05:39 +0000

ScreenShot00180

acheveldave — Wed, 29 Nov 2023 00:05:39 +0000

ScreenShot00162

acheveldave — Wed, 29 Nov 2023 00:05:40 +0000

ScreenShot00179

acheveldave — Wed, 29 Nov 2023 00:05:40 +0000

ScreenShot00163

acheveldave — Wed, 29 Nov 2023 00:05:40 +0000

ScreenShot00164

acheveldave — Wed, 29 Nov 2023 00:05:41 +0000

ScreenShot00165

acheveldave — Wed, 29 Nov 2023 00:05:41 +0000

ScreenShot00171

acheveldave — Wed, 29 Nov 2023 00:05:41 +0000

ScreenShot00172

acheveldave — Wed, 29 Nov 2023 00:05:42 +0000

ScreenShot00174

acheveldave — Wed, 29 Nov 2023 00:05:42 +0000

ScreenShot00175

acheveldave — Wed, 29 Nov 2023 00:05:42 +0000

ScreenShot00012

acheveldave — Wed, 29 Nov 2023 00:05:43 +0000

ScreenShot00013

acheveldave — Wed, 29 Nov 2023 00:05:43 +0000

ScreenShot00014

acheveldave — Wed, 29 Nov 2023 00:05:44 +0000

ScreenShot00015

acheveldave — Wed, 29 Nov 2023 00:05:44 +0000

ScreenShot00016

acheveldave — Wed, 29 Nov 2023 00:05:45 +0000

ScreenShot00017

acheveldave — Wed, 29 Nov 2023 00:05:45 +0000

ScreenShot00018

acheveldave — Wed, 29 Nov 2023 00:05:46 +0000

ScreenShot00019

acheveldave — Wed, 29 Nov 2023 00:05:46 +0000

ScreenShot00020

acheveldave — Wed, 29 Nov 2023 00:05:46 +0000

ScreenShot00021

acheveldave — Wed, 29 Nov 2023 00:05:47 +0000

ScreenShot00022

acheveldave — Wed, 29 Nov 2023 00:05:47 +0000

ScreenShot00023

acheveldave — Wed, 29 Nov 2023 00:05:47 +0000

ScreenShot00055

acheveldave — Wed, 29 Nov 2023 00:05:48 +0000

ScreenShot00044

acheveldave — Wed, 29 Nov 2023 00:05:48 +0000

ScreenShot00045

acheveldave — Wed, 29 Nov 2023 00:05:49 +0000

ScreenShot00046

acheveldave — Wed, 29 Nov 2023 00:05:49 +0000

ScreenShot00047

acheveldave — Wed, 29 Nov 2023 00:05:49 +0000

ScreenShot00048

acheveldave — Wed, 29 Nov 2023 00:05:50 +0000

ScreenShot00033

acheveldave — Wed, 29 Nov 2023 00:05:50 +0000

ScreenShot00040

acheveldave — Wed, 29 Nov 2023 00:05:50 +0000

ScreenShot00041

acheveldave — Wed, 29 Nov 2023 00:05:51 +0000

ScreenShot00042

acheveldave — Wed, 29 Nov 2023 00:05:51 +0000

ScreenShot00043

acheveldave — Wed, 29 Nov 2023 00:05:51 +0000

2

acheveldave — Wed, 29 Nov 2023 00:05:52 +0000

ScreenShot00056

acheveldave — Wed, 29 Nov 2023 00:05:52 +0000

ScreenShot00057

acheveldave — Wed, 29 Nov 2023 00:05:53 +0000

ScreenShot00058

acheveldave — Wed, 29 Nov 2023 00:05:53 +0000

ScreenShot00059

acheveldave — Wed, 29 Nov 2023 00:05:53 +0000

ScreenShot00067

acheveldave — Wed, 29 Nov 2023 00:05:53 +0000

ScreenShot00061

acheveldave — Wed, 29 Nov 2023 00:05:54 +0000

ScreenShot00062

acheveldave — Wed, 29 Nov 2023 00:05:54 +0000

ScreenShot00084

acheveldave — Wed, 29 Nov 2023 00:05:54 +0000

ScreenShot00085

acheveldave — Wed, 29 Nov 2023 00:05:54 +0000

ScreenShot00086

acheveldave — Wed, 29 Nov 2023 00:05:55 +0000

ScreenShot00087

acheveldave — Wed, 29 Nov 2023 00:05:55 +0000

ScreenShot00088

acheveldave — Wed, 29 Nov 2023 00:05:55 +0000

ScreenShot00089

acheveldave — Wed, 29 Nov 2023 00:05:56 +0000

ScreenShot00090

acheveldave — Wed, 29 Nov 2023 00:05:56 +0000

ScreenShot00016

acheveldave — Wed, 29 Nov 2023 00:05:56 +0000

ScreenShot00017

acheveldave — Wed, 29 Nov 2023 00:05:57 +0000

ScreenShot00064

acheveldave — Wed, 29 Nov 2023 00:05:57 +0000

ScreenShot00066

acheveldave — Wed, 29 Nov 2023 00:05:57 +0000

ScreenShot00062

acheveldave — Wed, 29 Nov 2023 00:05:57 +0000

ScreenShot00082

acheveldave — Wed, 29 Nov 2023 00:05:58 +0000

ScreenShot00083

acheveldave — Wed, 29 Nov 2023 00:05:58 +0000

ScreenShot00091

acheveldave — Wed, 29 Nov 2023 00:05:59 +0000

ScreenShot00092

acheveldave — Wed, 29 Nov 2023 00:05:59 +0000

ScreenShot00025

acheveldave — Wed, 29 Nov 2023 00:05:59 +0000

2022-04-25-03-05-30-image

acheveldave — Wed, 29 Nov 2023 00:06:00 +0000

templates

acheveldave — Wed, 29 Nov 2023 00:06:00 +0000

PANTemplate

acheveldave — Wed, 29 Nov 2023 00:06:01 +0000

80e78e649b7ec0c623e04d4235f4cbe743d16941

acheveldave — Wed, 29 Nov 2023 00:06:01 +0000

PANTemplate2

acheveldave — Wed, 29 Nov 2023 00:06:01 +0000

PANTemplate3

acheveldave — Wed, 29 Nov 2023 00:06:01 +0000

PANTemplate4

acheveldave — Wed, 29 Nov 2023 00:06:02 +0000

PANTemplate5

acheveldave — Wed, 29 Nov 2023 00:06:02 +0000

PANTemplate6

acheveldave — Wed, 29 Nov 2023 00:06:02 +0000

2022-03-16-18-28-58-image

acheveldave — Wed, 29 Nov 2023 00:06:03 +0000

PANTemplate7

acheveldave — Wed, 29 Nov 2023 00:06:03 +0000

PANTemplate8

acheveldave — Wed, 29 Nov 2023 00:06:03 +0000

PANTemplate9

acheveldave — Wed, 29 Nov 2023 00:06:03 +0000

cabling

acheveldave — Wed, 29 Nov 2023 00:06:04 +0000

PANTemplate10

acheveldave — Wed, 29 Nov 2023 00:06:05 +0000

NewPan

acheveldave — Wed, 29 Nov 2023 00:06:06 +0000

2022-03-29-17-28-01-image

acheveldave — Wed, 29 Nov 2023 00:06:06 +0000

PANTemplate11

acheveldave — Wed, 29 Nov 2023 00:06:06 +0000

PANTemplate12

acheveldave — Wed, 29 Nov 2023 00:06:06 +0000

PANTemplate13

acheveldave — Wed, 29 Nov 2023 00:06:07 +0000

2022-03-29-19-19-20-image

acheveldave — Wed, 29 Nov 2023 00:06:07 +0000

PANTemplate14

acheveldave — Wed, 29 Nov 2023 00:06:07 +0000

1.1 GNS3 and Palo Alto

acheveldave — Sat, 12 Mar 2022 02:56:29 +0000

Learning Objectives

Configure a static IP for the management port on the firewall
Change general settings of the firewall using the web interface

Scenario: In this lab, we're only going to start with the basics. Connecting to and configuring basic settings on Palo Alto. There will be a little console usage, but don't fret. The rest of these will involve some sort of GUI based option

[caption id="attachment_43" align="aligncenter" width="500"] Figure 1.1: Main Scenario[/caption]

Table 1.1: Addressing Table
Device	Configuration
PaloAlto-1	Management: 192.168.0.1/24
WebTerm1-Management	eth0: 192.168.0.2/24

Console into the Palo Alto Device

Make sure to start all your devices, then double click the Palo Alto device. You should see a console window pop up. We need to wait till the prompt changes to "PA-VM". Otherwise, we cannot login. [caption id="attachment_43" align="aligncenter" width="829"] Figure 1.2: No Login[/caption] After about 15 mins, hit enter, and the prompt should change. Login with the following credentials: Username: admin Password: admin

It will prompt you to change your password. Once you're finished changing your password, you will see the prompt change to this:

[caption id="attachment_43" align="aligncenter" width="829"] Figure 1.3: Firewall General mode[/caption]

Configure a Static IP on the Palo Alto Device

I promise you that this is one of the only times we will be interfacing with the command line. But this is necessary for setting up a static IP. Type these commands into the now open console:

1) configure 2) set deviceconfig system type static 3) set deviceconfig system ip-address 192.168.0.1 netmask 255.255.255.0 4) commit

Line 1: Gets you into configuration mode. Line 2: Configuration mode command to set the management interface to a static address. Line 3: Sets IP of the management interface. Line 4: Every time you make any change in Palo Alto, you must commit the changes for it to take effect. It should look like this if all commands were successful: [caption id="attachment_43" align="aligncenter" width="500"] Figure 1.4: Set a static IP address[/caption]

Access the Web Interface from Webterm

Double click on the webterm device. A Firefox window should immediately pop up: [caption id="attachment_43" align="aligncenter" width="600"] Figure 1.5: WebTerm Firefox browser[/caption] On the top address bar, type in “https://192.168.0.1” (without quotes) then hit enter.

After typing that in, you should see a block page:

[caption id="attachment_43" align="aligncenter" width="600"] Figure 1.6: Type IP address of Palo Alto[/caption]

To get past this, click advanced, then click “Accept the Risk”.

[caption id="attachment_43" align="aligncenter" width="600"] Figure 1.7: Past of security warning[/caption]

Now that we're past the scary-looking warning screen, type in the credentials to the user: admin. The password should be the password you set after initially logging in through the command line.

[caption id="attachment_43" align="aligncenter" width="600"] Figure 1.8: Enter credentials[/caption]

Now, we're in the web interface for the Palo Alto device!

[caption id="attachment_43" align="aligncenter" width="1026"] Figure 1.9: First page of Palo Alto[/caption]

Explore the Web Interface

Let's focus on what we'll actually be used as these labs progress. [caption id="attachment_43" align="aligncenter" width="1024"] Figure 1.10: Device Settings[/caption]

In device settings, we can change the hostname, create users, generate certs, etc. The bottom line is that it is used for general system administration. We will be delving more into this as the chapters progress.

[caption id="attachment_43" align="aligncenter" width="1024"] Figure 1.11: Network Interfaces Settings[/caption]

In network settings, we can change interface IP addresses, create tunnels, and setup routing.

[caption id="attachment_43" align="aligncenter" width="1024"] Figure 1.12: Objects Settings[/caption]

We won't be using the objects tab very much, however, it is important to know about it. Here, we can create pre-defined address objects, define ports, and create security policy templates.

[caption id="attachment_43" align="aligncenter" width="1024"] Figure 1.13: Policy Settings[/caption] The policies tab is arguably the most important tab of the firewall. Here we will configure security policies and define NAT rules. An important thing to note is these pre-existing security policies. Everything within a zone is allowed, whereas a zone to another zone is not allowed.

Change the Hostname of Palo Alto

Head over to the device tab, and click the cog icon to the right of device settings. [caption id="attachment_43" align="aligncenter" width="1024"] Figure 1.14: Changing hostname[/caption] Change the hostname to anything but PA-VM. I will change mine to “BruhloAlto”.

After changing the hostname to anything you desire, click on OK at the bottom right of the screen.

[caption id="attachment_43" align="aligncenter" width="1024"] Figure 1.15: General Settings[/caption]

After any change in Palo Alto, you will have to commit the changes. When you make changes in Palo Alto, it is put into what we call a “candidate configuration.” This means that changes do not take effect immediately. After we change some settings, we need to press the commit button on the top right.

[caption id="attachment_43" align="aligncenter" width="1024"] Figure 1.16: Commit Configuration[/caption]

Pressing commit will push the candidate configuration to the running configuration. This is helpful because the Palo Alto device is smart enough to tell you if a configuration won't work without affecting your active network settings. Let's commit these changes by clicking commit again.

[caption id="attachment_43" align="aligncenter" width="1024"] Figure 1.17: Commit all changes[/caption]

If all is well, after a while you should see something similar to this. It means everything worked!

[caption id="attachment_43" align="aligncenter" width="1024"] Figure 1.18: Configuration committed successfully[/caption]

Verify the Changes

Refresh the page by pressing the F5 key (or clicking on the refresh button) on the webterm web browser. If the hostname changed, the tab will change to the hostname you set. [caption id="attachment_43" align="aligncenter" width="400"] Figure 1.19: Verify configuration[/caption] You can also see the changes being reflected on the console interface if you press enter. [caption id="attachment_43" align="aligncenter" width="400"] Figure 1.20: Verify configuration in CLI[/caption]

1.2 DORA the DHCP Provider

acheveldave — Mon, 25 Apr 2022 11:28:57 +0000

Learning Objectives

Set up a DHCP server on Palo Alto
Set up zones
Connect clients to the internet with Palo Alto

Scenario: In this lab, we are going to configure our friend DORA (Discover Offer Request Acknowledge) the hander of addresses. And we'll also be configuring internet access so that clients may finally browse their precious Internet with SNAT (Source Network Address Translation).

[caption id="attachment_73" align="aligncenter" width="1078"] Figure 1.21: main scenario[/caption]

Table 1.2: Addressing Table
Device	Configuration
PaloAlto	management: 192.168.0.1/24 Ethernet1/1: 10.0.0.1/24 Ethernet1/2: DHCP
Client (WebTerm)	eth0: DHCP
Management (WebTerm)	eth0: 192.168.0.2/24

Table 1.3: Zone Configuration
Zones	Interfaces
Inside	Ethernet1/1
Outside	Ethernet1/2

Create Zones in the Palo Alto Web Interface

Under the network tab, click zones, then add on the bottom left of the screen. [caption id="attachment_73" align="aligncenter" width="500"] Figure 1.22: Creating zones[/caption] In here, we just change the name and type of zone. For information's sake. We will only be dealing with (mostly) layer 3 things in Palo Alto for this book. After that, press OK. Remember to create Inside and Outside zones (Remember to also commit changes from time to time!) [caption id="attachment_73" align="aligncenter" width="500"] Figure 1.23: Create a zone Inside as a layer3[/caption] [caption id="attachment_73" align="aligncenter" width="500"] Figure 1.24: Create a zone Outside as a layer3[/caption]

Set Up a Static Interface IP Address in Palo Alto

Go under the network tab, and click on ethernet1/1. [caption id="attachment_73" align="aligncenter" width="500"] Figure 1.25: Select Ethernet 1/1[/caption]

The first thing we want to do when configuring an interface is changing the interface type to layer 3, the virtual router to default, and changing the security zone to the desired zone. In this case, we have to change it to inside for ethernet1/1, and outside for ethernet1/2.

[caption id="attachment_73" align="aligncenter" width="400"] Figure 1.26: Ethernet 1/1 Configuration[/caption] Now, under the IPv4 tab of the opened window, click on Add, then type in the address and prefix of the interface. [caption id="attachment_73" align="aligncenter" width="400"] Figure 1.27: Set an IP address for Ethernet 1/1[/caption]

Ping an Interface in Palo Alto

By default, a Palo Alto interface is not pingable. In a lab environment, checking if pings are working is a good sanity test. Go to the advanced tab, click the drop-down menu next to the management profile, then click New. [caption id="attachment_73" align="aligncenter" width="1026"] Figure 1.28: Ethernet 1/1 configuration - Advanced Tab[/caption]

Call this whatever you want, but make sure to tick the ping option under networking services. Then press OK.

[caption id="attachment_73" align="aligncenter" width="1024"] Figure 1.29: Enable Ping under Interface Management Profile[/caption]

Enable DHCP on an Interface in Palo Alto

It's almost the same thing as setting up a static interface, but you act differently in the IPV4 menu. Instead of typing in an IP address and mask, you just specify that this is a DHCP client. [caption id="attachment_73" align="aligncenter" width="1024"] Figure 1.30: Enable DHCP Client on Ethernet 1/2[/caption] Don't forget to commit your changes!

If all is well after a commit, you will be able to check your DHCP IP address by clicking "dynamic DHCP client" in the main network menu.

[caption id="attachment_73" align="aligncenter" width="400"] Figure 1.31: Dynamic DHCP Client- Receive an IP address from DHCP Server[/caption] Here is an example of that: [caption id="attachment_73" align="aligncenter" width="400"] Figure 1.32: IP Address of Interface 1/2[/caption]

Set Up a DHCP Server in Palo Alto

In the network tab, click on DHCP, then click Add. [caption id="attachment_73" align="aligncenter" width="400"] Figure 1.33: Add a DHCP Server[/caption] First, we need to define the interface, I set that to ethernet1/1 because it is our LAN. Then, I press Add and define a range that fits the network subnet. [caption id="attachment_73" align="aligncenter" width="500"] Figure 1.34: Set an IP Pools for Interface 1/1[/caption] After that, we need to configure some DHCP options under the options tab. Here we need to define the gateway, (which is usually the interface IP address) subnet mask (which is usually 255.255.255.0), and a DNS server. I just use Google's DNS server as an example. [caption id="attachment_73" align="aligncenter" width="500"] Figure 1.35: Set a Gateway and a primary DNS[/caption] Again, remember to commit your changes!

Ping Palo Alto from a LAN Device

When opening up your webterm for "Client", click the bottom left button, then click terminal. [caption id="attachment_73" align="aligncenter" width="500"] Figure 1.36: Open Terminal in WebTerm1[/caption]

Type in ip a or ifconfig on the terminal. If you see an IP address under eth0, the DHCP Server worked!

[caption id="attachment_73" align="aligncenter" width="500"] Figure 1.37: Check the IP address in Terminal[/caption]

Now, let's ping our Palo Alto device. Type in ping 10.0.0.1. If all works out, you should see this:

[caption id="attachment_73" align="aligncenter" width="500"] Figure 1.38: Ping 10.0.0.1 in the terminal[/caption] This means that everything so far worked! Press Ctrl+C to stop pinging the Palo Alto device.

Security Profile Basics

In the policies tab, we want to create a new policy. Click on new in the bottom left of the Palo Alto web interface. [caption id="attachment_73" align="aligncenter" width="400"] Figure 1.39: Add a Security Policy[/caption] Under the general tab, we just want to give it a name. We will only be working with universal rules. [caption id="attachment_73" align="aligncenter" width="400"] Figure 1.40: Set a Name for Security Policy[/caption]

Under the source tab, we specify the inside zone (from). In this case, it will be the "Inside" zone.

[caption id="attachment_73" align="aligncenter" width="400"] Figure 1.41: Set a Source Zone for Security Policy[/caption] Under the outside tab (to). Specify the outside zone. [caption id="attachment_73" align="aligncenter" width="400"] Figure 1.42: Set a Destination Zone for Security Policy[/caption] After that, press OK to confirm.

SNAT (Source NAT: Access the Internet in Palo Alto)

Under the policies tab, go to NAT, then click Add. [caption id="attachment_73" align="aligncenter" width="1026"] Figure 1.43: Set a NAT[/caption]

In this case, we want to translate packets originating from the Inside to go to the outside zone using the interface address of ethernet1/2. This would be Port Address Translation Overload. Under the general tab, just change the name.

[caption id="attachment_73" align="aligncenter" width="1026"] Figure 1.44: Set a Name for NAT[/caption]

Under the original packet tab, click Add then make the source zone inside. As for the destination zone, make it outside.

[caption id="attachment_73" align="aligncenter" width="1024"] Figure 1.45: Set a Source Zone and Destination Zone for NAT[/caption]

Under translated packet on source address translation. Specify the translation type as Dynamic IP and port, the address type as interface address, and the interface as ethernet1/2(The interface in the outside zone) After that, click OK.

[caption id="attachment_73" align="aligncenter" width="1026"] Figure 1.46: Set a Translated Packet[/caption]

Don't forget to commit!

Check Internet Connectivity on Webterm

In webterm, you could test pinging 8.8.8.8 like so: [caption id="attachment_73" align="aligncenter" width="400"] Figure 1.47: Verify your configuration[/caption] Or you can try navigating to a website for example https://something.com. [caption id="attachment_73" align="aligncenter" width="400"] Figure 1.48: Verify your connectivity to the Internet[/caption] If both of these work. You have successfully configured DHCP and SNAT properly!

1.4 DNAT

acheveldave — Mon, 25 Apr 2022 11:29:09 +0000

Learning Objectives

Configure Destination NAT (DNAT)
Configure WordPress

Prerequisites:

SNAT for the Internet
Security policy for Inside to Outside
Interface configuration
Knowledge of previous labs

Scenario: When I think of DNAT (Destination Network Address Translation) I always think of the days of setting up port forwarding for all my favorite games just so I could host server friends can play on. You can think of DNAT like this too if it helps! The goal of this lab is to reach WordPress from the Outside. So, users only enter the IP address of Ethernet 1/2 in the Outside webterm and the firewall redirects the traffic to WordPress.

[caption id="attachment_94" align="aligncenter" width="500"] Figure 1.55: Main scenario[/caption]

Table 1.7: Addressing Table
Device	Configuration
WP (WordPress)	eth0: 10.0.0.2/24 GW: 10.0.0.1
PaloAlto	Ethernet1/1: 10.0.0.1/24 Ethernet1/2: DHCP Management: 192.168.0.1/24
Management (WebTerm)	eth0: 192.168.0.2/24
Outside (WebTerm)	eth0: DHCP

Table 1.8: Zone Configuration
Zone	Interface
Inside	Ethernet1/1
Outside	Ethernet1/2

Create Reference Addresses

Under Objects > Addresses, click Add. [caption id="attachment_94" align="aligncenter" width="1026"] Figure 1.56: Add an address[/caption]

In this window, we will add the IP of the WordPress server to reference it easier.

[caption id="attachment_94" align="aligncenter" width="1026"] Figure 1.57: WordPress IP address[/caption]

We also want to put our firewall's "public" IP (the interface facing the NAT cloud) here too. You can find the firewall's DHCP address under network > interfaces. Then click the hyperlink under IP address:

[caption id="attachment_94" align="aligncenter" width="1024"] Figure 1.58: Dynamic-DHCP Client IP address[/caption]

From there you will find the IP address of the firewall:

[caption id="attachment_94" align="aligncenter" width="1026"] Figure 1.59: Verify Dynamic-DHCP Client IP address[/caption]

Create a DNAT Policy

Under Policies > NAT, click the Add button on the bottom. [caption id="attachment_94" align="aligncenter" width="1026"] Figure 1.60: Add a DNAT Policy[/caption] Under the Original Packet tab, configure these settings:

Table 1.9: DNAT Configuration
Parameters	Value
Source Zone	Outside
Destination Zone	Outside
Destination Interface	any
Service	service-http
Destination Address	(Firewall Public Address Here)

[caption id="attachment_94" align="aligncenter" width="1026"] Figure 1.61: DNAT Policy Rule- Original Packet[/caption]

Under the translated packet tab, Destination Address Translation. Configure these:

Table 1.10: DNAT Translated Packet Configuration
Parameters	Value
Translation Type	Static IP
Translated Address	(IP of WordPress here)
Translated Port	80

[caption id="attachment_94" align="aligncenter" width="1026"] Figure 1.62: DNAT Policy Rule- Translated Packet[/caption] Then, press OK.

Security Policy for DNAT

Under Policies > Security. Click Add at the bottom. [caption id="attachment_94" align="aligncenter" width="1026"] Figure 1.63: Add a Security Policy[/caption]

Under the source tab, add the outside zone under the source zone:

[caption id="attachment_94" align="aligncenter" width="1026"] Figure 1.64: Configuring the Source Zone[/caption]

Under the destination tab, add the inside zone as the destination zone:

[caption id="attachment_94" align="aligncenter" width="1026"] Figure 1.65: Configuring the Destination Zone[/caption] After that press OK, then Commit.

Test DNAT

Using the Outside webterm. Navigate to the public IP address of your firewall. If any webpage shows up, whether it's the WordPress site or the one below. You got DNAT working! [caption id="attachment_94" align="aligncenter" width="1026"] Figure 1.66: Verify your configuration[/caption]

2.1 Work with Applications

acheveldave — Mon, 25 Apr 2022 11:31:12 +0000

Learning Objectives

Configure security policies

Prerequisites:

Knowledge of previous labs
SNAT for internet access
Security Policy from Inside to Outside

Scenario: Employees can doze off and do other things that they're not supposed to do during work time. If only there was an easy application-aware next-generation firewall that can block these applications! (Hint: It's this firewall!) In this lab, we are going to add applications to the security policy to only allow specific traffic to pass through the firewall.

[caption id="attachment_102" align="aligncenter" width="987"] Figure 2.1: Main scenario[/caption]

Table 2.1: Addressing Table
Device	Configuration
Client (webterm)	eth0: 10.0.0.2/24 GW: 10.0.0.1
PaloAlto	Ethernet1/1: 10.0.0.1/24 Ethernet1/2: DHCP Management: 192.168.0.1/24
Management (webterm)	eth0: 192.168.0.2/24

Table 2.2: Zone Configuration
Zone	Interface
Inside	Ethernet1/1
Outside	Ethernet1/2

Modify Allowed Applications

Under polices > security, create a new security policy that allows inside to outside. [caption id="attachment_102" align="aligncenter" width="1026"] Figure 2.2: Create a Security Policy[/caption] Under the application tab, add these under applications:

dns
ssl
web-browsing
dns-over-https

These will allow only basic web browsing. [caption id="attachment_102" align="aligncenter" width="1026"] Figure 2.3: Set a custom application[/caption] Press OK, and commit the changes.

Test the Policy

On the client machine, navigate to any website, and you'll see it works: [caption id="attachment_102" align="aligncenter" width="400"] Figure 2.4: Verify your configuration[/caption] However, you'll notice that ping will not function: [caption id="attachment_102" align="aligncenter" width="400"] Figure 2.5: Verify Ping[/caption] You can allow Ping application under application settings and then you can verify whether you are able to Ping or not.

2.2 Deal with Bad Actors

acheveldave — Mon, 25 Apr 2022 11:31:32 +0000

Learning Objectives

Restrict certain websites
Deal with DoS floods

Prerequisites:

SNAT for the Internet
Security policy for Inside to Outside
Interface configuration
Knowledge of previous labs

Scenario: In this lab, we will learn how to block a specific website and how to prevent script kiddies from succeeding with the infinite ping tool they downloaded from the sketchiest site you've ever seen. Kali acts like an attacker machine and we are going to attack the firewall through port Ethernet1/2. Then, we'll enable DoS Prevention in the firewall to prevent attacks.

[caption id="attachment_138" align="aligncenter" width="1164"] Figure 2.6: Main scenario[/caption]

Table 2.3: Addressing Table
Device	Configuration
PaloAlto-1	management: 192.168.0.1/24 Ethernet1/1: 10.0.0.1/24 Ethernet1/2: DHCP
Client (webterm)	eth0: 10.0.0.2/24 GW: 10.0.0.1 DNS: 8.8.8.8
Management (webterm)	eth0: 192.168.0.2/24
KaliLinux2019-3-1	eth0: DHCP

Table 2.4: Zone Configuration
Zone	Interfaces
Inside	Ethernet1/1
Outside	Ethernet1/2

Create a URL Category

Under object > custom objects > URL category, click Add. Click cancel on the pop-up. [caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.7: Create a Custom URL Category[/caption]

Here we can block 5, 6, or multiple sites. But here we will use just 1. Give it a name, then click Add.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.8: Add a CustomURL Category[/caption] Enter some websites you would like to block. Here I have added a sample website (www.thegreattechadventure.com) you can also use wildcards if you want. After you're done. Click OK.

Block a Website

Under Policies > Security. Click Add: [caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.9: Add a security policy[/caption]

Under the source tab, add the Inside zone under the source zone:

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.10: Add a Source Zone[/caption]

Under the destination tab, add the Outside zone under the destination zone:

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.11: Add a Destination Zone[/caption]

Under the Service/URL Category tab, add the created URL category you created in the previous step.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.12: Assign URL Category[/caption]

Under the actions page, set the action to deny.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.13: Set an Action to Deny[/caption] Then click OK.

Enable Block Pages

Under Device > Response pages. Click on Disabled beside Application Block Page. [caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.14: Enabling Application Block Page[/caption]

Tick on the enable checkbox, then press OK.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.15: Enabling Application Block Page[/caption] Make sure to commit your changes!

Test the Blocked URL

Open up Firefox on the Client machine, and try to connect to the URL you blocked. If all is right, you should see a blocked page. [caption id="attachment_138" align="aligncenter" width="400"] Figure 2.16: Application Block Page[/caption] If you see this page, that is alright too! [caption id="attachment_138" align="aligncenter" width="400"] Figure 2.17: Application Block Page[/caption]

Set Up Kali to Be a Bad Actor

After entering into the live graphical environment and testing for internet connection. Open up the terminal. [caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.18: Open up Terminal in Kali[/caption] We will be using Pentmenu by GinjaChris to demonstrate a flood. Run these commands to download and run the application:

#git clone https://github.com/GinjaChris/pentmenu #cd pentmenu #chmod +x pentmenu #./pentmenu

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.19: PentMenu app[/caption]

Select option 2 for DoS attack.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.20: PentMenu app - Select DoS (2)[/caption]

Select option 1 for ICMP Echo Flood.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.21: PentMenu app - Select ICMP Echo Flood(1)[/caption]

For the IP, use the IP of the interface in the outside zone. It should be in the 192.168.122.0/24 range.

[caption id="attachment_138" align="aligncenter" width="1819"] Figure 2.22: PentMenu app - Enter Target IP address[/caption]

Select r for random IP address.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.23: PentMenu app - Enter r for random IP address[/caption] After about 2 seconds, press Ctrl+C.

Analyze the ICMP Flood

Back on the Management machine, go under Monitor > Session browser. [caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.24: Verify session logs[/caption] As you can see, there are many entries here for ping. We want to prevent floods like these.

Create a DoS Protection Profile

Under Objects > Security Profiles > DoS Protection. Click Add. [caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.25: Create a DoS Protection[/caption]

Set the type to Classified and under Flood protection, click the checkbox on the SYN Flood, UDP Flood, and ICMP Flood tabs.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.26: SYN Flood Protection[/caption] After that, click OK.

Apply the DoS Protection Profile

Under Policies > Dos Protection. Click Add. [caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.27: Add a DoS Protection Rule[/caption]

Under the Source tab, add the Outside zone.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.28: Add the Source Zone[/caption]

Under the Destination tab, add the Inside zone.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.29: Add the Destination Zone[/caption] Under the Option/Protection tab, configure these settings:

Table 2.5: DoS Rule Protection Configuration
Parameter	Value
Action	Protect
Schedule	None
Log Forwarding	None
Aggregate	None
Classified	Tick this box
Profile	The name of the one you created
Address	source-IP-only

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.30: DoS Rule - Option/Policies[/caption] Then click OK.

Create a Zone Protection Profile

Under Network > Network Profiles > Zone Protection. Click Add. [caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.31: Add a Zone Protection[/caption]

Under the flood protection tab, tick SYN, ICMP, and UDP.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.32: Add a Flood Protection[/caption]

Under the Reconnaissance Protection tab, tick enables on all boxes, and change the action to block.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.33: Set UDP Port Scan[/caption]

Under the Packet Based Attack Protection tab, under the IP drop subtab, tick on Spoofed IP address and Strict IP Address Check.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.34: Enable Spoof IP address and Strict Address Check[/caption]

Under the Packet Based Attack Protection tab, under the TCP drop subtab, tick on TCP SYN with Data and TCP SYNACK with Data.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.35: Enable TCP SYN with Data[/caption]

Under the Packet Based Attack Protection tab, under the ICMP drop subtab, tick on ICMP Ping ID 0, ICMP Fragment, and ICMP Large Packet(>1024).

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.36: Enable ICMP Ping ID 0, ICMP Fragment[/caption] Then click OK.

Apply a Zone Protection Profile

Under Network > Zones. Click on the Outside Zone. [caption id="attachment_138" align="aligncenter" width="1024"] Figure 2.37: Create an Outside zone[/caption]

Under the Zone Protection category, select the profile you just created.

[caption id="attachment_138" align="aligncenter" width="1026"] Figure 2.38: Enable Zone Protection under Outside Zone[/caption] Click OK. Don't forget to commit your changes!

Test the DoS Protection

Run Pentmenu again using the previous options, then Ctrl+C after 3 seconds. [caption id="attachment_138" align="aligncenter" width="400"] Figure 2.39: Running PentMenu[/caption] Under Monitor > Logs > Threat. You should see an entry for an ICMP flood. [caption id="attachment_138" align="aligncenter" width="400"] Figure 2.40: Verify logs[/caption]

PANTemplate15

acheveldave — Wed, 29 Nov 2023 00:06:08 +0000

PANTemplate16

acheveldave — Wed, 29 Nov 2023 00:06:08 +0000

PANTemplate17

acheveldave — Wed, 29 Nov 2023 00:06:08 +0000

2022-04-18-01-22-13-image

acheveldave — Wed, 29 Nov 2023 00:06:08 +0000

2022-04-18-01-23-39-image

acheveldave — Wed, 29 Nov 2023 00:06:09 +0000

2022-04-23-13-15-04-image

acheveldave — Wed, 29 Nov 2023 00:06:09 +0000

2022-04-23-13-16-10-image

acheveldave — Wed, 29 Nov 2023 00:06:09 +0000

2022-04-23-13-16-54-image

acheveldave — Wed, 29 Nov 2023 00:06:10 +0000

PANTemplate18

acheveldave — Wed, 29 Nov 2023 00:06:10 +0000

Appendix: GNS3 Basics

acheveldave — Fri, 27 Oct 2023 20:51:15 +0000

In this chapter, we'll be going through the basics in GNS3. Try to play and familiarize yourself with this environment as this is a good tool for network simulations.

Configure Your Palo Alto Firewall Template and Adding the Device

Lets start by modifying the GNS3 template of the Palo Alto firewall by right clicking the existing template, and clicking on "configure template". [caption id="attachment_362" align="aligncenter" width="444"] Figure A.1: Configure template[/caption]

Make sure the max amount of RAM is set to at least 4096MB, and the amount of vCPUs are at least 2.

[caption id="attachment_362" align="aligncenter" width="500"] Figure A.2: Configure RAM and vCPUs[/caption]

Now close the window, and drag in the Palo Alto device from the left hand pane.

[caption id="attachment_362" align="aligncenter" width="744"] Figure A.3: Dragging the Palo Alto[/caption] Once you've dragged in the Palo Alto device, right click it, then click "start". [caption id="attachment_362" align="aligncenter" width="300"] Figure A.4: Starting the Palo Alto[/caption] Keep in mind that this device takes a while to start.

Webterm Installation

Let's begin by clicking "new template" on the bottom left hand of GNS3. [caption id="attachment_362" align="aligncenter" width="1113"] Figure A.5: Add a new template[/caption]

We want to install this into the GNS3 VM. Click on the option to "Install an appliance from the GNS3 Server", then click Next.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.6: Select "Install an appliance from the GNS3 server"[/caption]

On the next window, search for "webterm", select the option under "guests", then click install.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.7: Search for "webterm"[/caption]

On the next screen, ensure that "install the appliance on the GNS3 VM", is already selected, then click Next.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.8: Select "Install the appliance on the GNS3 VM"[/caption]

On the next screen, click Finish.

[caption id="attachment_362" align="aligncenter" width="1004"] Figure A.9: Final step of Installation of webterm[/caption] After that, it should appear under all devices in GNS3.

Configure Your Webterm Device with a Static IP

Drag in the webterm device from the left pane. Then once it finishes downloading the docker file, right click it and select "edit config". [caption id="attachment_362" align="aligncenter" width="400"] Figure A.10: Edit config[/caption]

A window will pop up containing the device's network configuration. We want to modify this file to match the specified IP address. The final modification should look like a little like this:

[caption id="attachment_362" align="aligncenter" width="500"] Figure A.11: Configure the static IP address[/caption] After these modifications, click on the save button on the bottom right of the window.

Configure a Webterm DHCP Client

We just need to uncomment these 2 lines to enable DHCP. Click on save and we're done. [caption id="attachment_362" align="aligncenter" width="770"] Figure A.12: Configure the DHCP IP address[/caption]

Connect Devices in GNS3

Please see the example in the GIF below (if using an offline version of this book, go to the web version of the appendix of Palo Alto Firewall): [caption id="attachment_362" align="aligncenter" width="720"] Figure A.13: Connecting devices[/caption]

Use NAT in GNS3

The NAT device in GNS3 will allow devices in our virtual topology to communicate with the internet. This device is under the all devices section of GNS3. [caption id="attachment_362" align="aligncenter" width="500"] Figure A.14: Using NAT[/caption] Make sure you select the GNS3VM as the option whenever you see this window (applies for all devices). [caption id="attachment_362" align="aligncenter" width="414"] Figure A.15: Select GNS3 VM[/caption]

Use Kali in GNS3

Sometimes we need to use Kali to demonstrate an attack. Please keep in mind that Kali is used strictly for testing purposes. Let's begin by clicking "new template" on the bottom left hand of GNS3. [caption id="attachment_362" align="aligncenter" width="1113"] Figure A.16: Create a new template[/caption]

We want to install this into the GNS3 VM. Click on the option to "Install an appliance from the GNS3 Server", then click Next.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.17: Select "Install an appliance from the GNS3 server"[/caption]

On the next window, search for "kali", and select the non "CLI" option.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.18: Search for "kali"[/caption]

On the next screen, ensure that "install the appliance on the GNS3 VM", is already selected, then click Next.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.19: Select "Install the appliance on the GNS3 VM"[/caption]

Next again.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.20: Select Qemu binary[/caption]

Expand the "2019" option, and download both missing files. Also, you can download the latest version. Version 2019 is more stable in GNS3.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.21: Select "kali-linux-2019.3-amd64.iso"[/caption]

After that, import the downloaded file to the specified 2019 selection.

[caption id="attachment_362" align="aligncenter" width="946"] Figure A.22: Select "kali-linux-2019.3-amd64.iso"[/caption]

It should take a second, but GNS3 will start to load up the ISO into the GNS3VM.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.23: Loading the ISO image[/caption]

After that, click the 2019 version again, then click Next.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.24: Ready to install[/caption]

Then click Finish.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.25: Final step of configuration[/caption]

Use WordPress in GNS3

Sometimes we need a basic webserver to demonstrate website functionality. This can be accomplished using the WordPress appliance in GNS3. Start by clicking the new template button on the bottom of the page. [caption id="attachment_362" align="aligncenter" width="1113"] Figure A.26: Create a new template[/caption]

We want to install an appliance from the GNS3 server.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.27: Select "Install an appliance from the GNS3 server"[/caption]

Lookup "WordPress", then click Install.

[caption id="attachment_362" align="aligncenter" width="902"] Figure A.28: Search for "WordPress"[/caption] Just press next for the following dialog boxes, and you should now have WordPress! [caption id="attachment_362" align="aligncenter" width="636"] Figure A.29: Verify WordPress Installation[/caption]

Configure WordPress

After changing the interface configuration, start the machine. You will see a dialogue box: [caption id="attachment_362" align="aligncenter" width="1144"] Figure A.30: Running WordPress[/caption] Press enter and you'll see the device under some basic configuration. Once you get to the prompt, you can exit that window, and you will have WordPress ready! [caption id="attachment_362" align="aligncenter" width="1154"] Figure A.31: WordPress is Ready![/caption]

Use Switches in GNS3

Usually we just use switches to connect multiple devices together in GNS3. However, it can also be used for VLANs. Start by dragging one in and double clicking it. [caption id="attachment_362" align="aligncenter" width="450"] Figure A.32: Switch Configuration[/caption] Here you can see that they are all basically untagged. To configure a specific port, simply double click your desired port. [caption id="attachment_362" align="aligncenter" width="450"] Figure A.33: Double click on port7[/caption]

Configure the necessary settings for them (access is for tagging, dot1q is for trunking).

[caption id="attachment_362" align="aligncenter" width="450"] Figure A.34: Select port7 as dot1q[/caption] Click on add to apply the changes. [caption id="attachment_362" align="aligncenter" width="450"] Figure A.35: Click on Add to apply the changes[/caption] Then click Apply and OK.

Acknowledgements

acheveldave — Tue, 28 Nov 2023 17:22:00 +0000

We would like to thank Kacem Habiballah and Tim Carson for their great support during the project. Also, I appreciate BCcampus for the financial support of this project. We would like to thank my great students and friends Lewis Saludo, Tung Lee, and Jason Manning for their thoughtful feedback and great suggestions during this project.

xavhead3

acheveldave — Wed, 29 Nov 2023 00:06:10 +0000

About the Authors

acheveldave — Mon, 20 Nov 2023 18:08:03 +0000

Hamid Talebi

Hamid Talebi is an IT engineer with 14 years of experience and is a faculty member at Computer Information System Administration (CISA), School of Energy at BCIT. He has a Master of Science (MS) degree in Network Security. He has expertise and experience working with FortiGate and Palo Alto Firewalls, and SIEM software such as Qradar IBM, FortiSIEM, Splunk, and ArcSight. Before joining BCIT, Hamid held multiple roles IT security roles with a number of reputable organizations, such as the Canadian Institute for Cybersecurity and Bell. He designed and implemented a honeynet for the CIC and created a large IPS/IDS dataset over AWS for the CSE. He has been working in developing strong information security architectures with an Agile Project Management delivery methodology and assisting in the development of client IT and security strategies. Hamid has taught Network Security Fundamentals, Enterprise Network Security (FortiGate), Advanced Network Security (Palo Alto – Splunk – FortiSIEM), and Network Programming with Python at BCIT.

Xavier Cawley

Xavier Cawley is a Junior Devops Engineer and recent graduate of the CISA program at BCIT. He has always had an interest in and knack for technology ever since the age of 10, whether it was fiddling with jumpers, or automating some tedious tasks for school. Whilst participating in the CISA program, Xavier was well known for creating guides and documentation for several classes and aiding students on labs and assignments.

Versioning History

acheveldave — Tue, 19 Jul 2022 19:30:44 +0000

This page provides a record of edits and changes made to this book since its initial publication. Whenever edits or updates are made in the text, we provide a record and description of those changes here. If the change is minor, the version number increases by 0.01. If the edits involve substantial updates, the version number increases to the next full number. The files posted by this book always reflect the most recent version. If you find an error in this book, please fill out the Report an Error form.

Version	Date	Change	Details
1.00	November 29, 2023	Book published.	First version.

Palo Alto Firewall Style Sheet

acheveldave — Wed, 29 Nov 2023 17:43:45 +0000

Authors

acheveldave — Wed, 29 Nov 2023 00:03:09 +0000

Cover

acheveldave — Wed, 29 Nov 2023 00:03:09 +0000

About

acheveldave — Wed, 29 Nov 2023 00:03:09 +0000

Buy

acheveldave — Wed, 29 Nov 2023 00:03:09 +0000

Book Information

acheveldave — Wed, 29 Nov 2023 00:03:09 +0000

Accessibility Statement

acheveldave — Tue, 19 Jul 2022 19:12:46 +0000

BCcampus Open Education believes that education must be available to everyone. This means supporting the creation of free, open, and accessible educational resources. We are actively committed to increasing the accessibility and usability of the textbooks we produce.

Accessibility of This Textbook

The web version of this resource has been designed to meet Web Content Accessibility Guidelines 2.0, level AA. In addition, it follows all guidelines in Appendix A: Checklist for Accessibility of the Accessibility Toolkit – 2nd Edition. It includes:

Easy navigation. This text has a linked table of contents and uses headings in each chapter to make navigation easy.
Accessible images. All images in this text that convey information have alternative text. Images that are decorative have empty alternative text.
Accessible links. All links use descriptive link text.

Accessibility Checklist
Element	Requirements	Pass?
Headings	Content is organized under headings and subheadings that are used sequentially.	Yes
Images	Images that convey information include alternative text descriptions. These descriptions are provided in the alt text field, in the surrounding text, or linked to as a long description.	Yes
Images	Images and text do not rely on colour to convey information.	Yes
Images	Images that are purely decorative or are already described in the surrounding text contain empty alternative text descriptions. (Descriptive text is unnecessary if the image doesn’t convey contextual content information.)	Yes
Tables	Tables include row and/or column headers that have the correct scope assigned.	Yes
Tables	Tables include a title or caption.	Yes
Tables	Tables do not have merged or split cells.	Yes
Tables	Tables have adequate cell padding.	Yes
Multimedia	Videos have captions of all speech content and relevant non-speech content that has been edited by a human for accuracy.	Yes
Links	The link text describes the destination of the link.	Yes
Links	Links do not open new windows or tabs. If they do, a textual reference is included in the link text.	Yes
Links	Links to files include the file type in the link text.	Yes
Font	Font size is 12 point or higher for body text.	Yes
Font	Font size is 9 point for footnotes or endnotes.	Yes
Font	Font size can be zoomed to 200% in the webbook or eBook formats.	Yes

Known Accessibility Issues and Areas for Improvement

The book relies heavily on screenshots from the Palo Alto firewall software. These screenshots do not have alt text. While many of the screenshots are described in the surrounding text, the book has not been reviewed to ensure that the surrounding text is an adequate alternative for all images in the book.

Let Us Know if You are Having Problems Accessing This Book

We are always looking for ways to make our textbooks more accessible. If you have problems accessing this textbook, please contact us to let us know so we can fix the issue. Please include the following information:

The name of the textbook
The location of the problem by providing a web address or page description.
A description of the problem
The computer, software, browser, and any assistive technology you are using that can help us diagnose and solve your issue (e.g., Windows 10, Google Chrome (Version 65.0.3325.181), NVDA screen reader)

You can contact us one of the following ways:

Web form: BCcampus IT Support
Web form: Report an Error

This statement was last updated on November 29, 2023. The Accessibility Checklist table was adapted from one originally created by the Rebus Community and shared under a CC BY 4.0 License.

For Students: How to Access and Use this Textbook

acheveldave — Tue, 19 Jul 2022 19:14:12 +0000

This textbook is available in the following formats:

Online webbook. You can read this textbook online on a computer or mobile device in one of the following browsers: Chrome, Firefox, Edge, and Safari.
PDF. You can download this book as a PDF to read on a computer (Digital PDF) or print it out (Print PDF).
Mobile. If you want to read this textbook on your phone or tablet, you can use the EPUB (eReader) file.
HTML. An HTML file can be opened in a browser. It has very little style so it doesn't look very nice, but some people might find it useful.

For more information about the accessibility of this textbook, see the Accessibility Statement. You can access the online webbook and download any of the formats for free here: Palo Alto Firewall: Practical Guidance and Hands-On Labs. To download the book in a different format, look for the "Download this book" drop-down menu and select the file type you want.

How can I use the different formats?
Format	Internet required?	Device	Required apps	Accessibility Features	Screen reader compatible
Online webbook	Yes	Computer, tablet, phone	An Internet browser (Chrome, Firefox, Edge, or Safari)	WCAG 2.0 AA compliant, option to enlarge text, and compatible with browser text-to-speech tools	Yes
PDF	No	Computer, print copy	Adobe Reader (for reading on a computer) or a printer	Ability to highlight and annotate the text. If reading on the computer, you can zoom in.	Unsure
EPUB	No	Computer, tablet, phone	An eReader app	Option to enlarge text, change font style, size, and colour.	Unsure
HTML	No	Computer, tablet, phone	An Internet browser (Chrome, Firefox, Edge, or Safari)	WCAG 2.0 AA compliant and compatible with browser text-to-speech tools.	Yes

Tips for Using This Textbook

Search the textbook.
- If using the online webbook, you can use the search bar in the top right corner to search the entire book for a key word or phrase. To search a specific chapter, open that chapter and use your browser's search feature by hitting [Cntr] + [f] on your keyboard if using a Windows computer or [Command] + [f] if using a Mac computer.
- The [Cntr] + [f] and [Command] + [f] keys will also allow you to search a PDF, HTML, and EPUB files if you are reading them on a computer.
- If using an eBook app to read this textbook, the app should have a built-in search tool.
Navigate the textbook.
- This textbook has a table of contents to help you navigate through the book easier. If using the online webbook, you can find the full table of contents on the book's homepage or by selecting "Contents" from the top menu when you are in a chapter.
Annotate the textbook.
- If you like to highlight or write on your textbooks, you can do that by getting a print copy, using the Digital PDF in Adobe Reader, or using the highlighting tools in eReader apps.

About BCcampus Open Education

acheveldave — Tue, 19 Jul 2022 19:15:23 +0000

Palo Alto Firewall: Practical Guidance and Hands-On Labs by Hamid Talebi and Xavier Cawley was funded by BCcampus Open Education. BCcampus Open Education began in 2012 as the B.C. Open Textbook Project with the goal of making post-secondary education in British Columbia more accessible by reducing students’ costs through the use of open textbooks and other OER. BCcampus supports the post-secondary institutions of British Columbia as they adapt and evolve their teaching and learning practices to enable powerful learning opportunities for the students of B.C. BCcampus Open Education is funded by the Ministry of Post-Secondary Education and Future Skills and the Hewlett Foundation. Open educational resources (OER) are teaching, learning, and research resources that, through permissions granted by the copyright holder, allow others to use, distribute, keep, or make changes to them. Our open textbooks are openly licensed using a Creative Commons licence and are offered in various eBook formats free of charge, or as printed books that are available at cost. For more information about open education in British Columbia, please visit the BCcampus Open Education website. If you are an instructor who is using this book for a course, please fill out our Adoption of an Open Textbook form.

This book was produced using the following styles: Palo Alto Firewall: Practical Guidance and Hands-On Labs Style Sheet [Word file]

Dedication

acheveldave — Mon, 02 May 2022 19:30:06 +0000

This book is dedicated to to our loving parents.

A Practical Introduction

acheveldave — Sat, 12 Mar 2022 02:56:29 +0000

The Fundamental Theory

Palo Alto is a next-generation firewall. This means that it uses more advanced techniques to detect threats compared to a traditional firewall. Where a more traditional firewall would inspect source and destination IP addresses and ports, a next generation firewall would detect an application, user, or piece of content. From there we can choose to either allow, block, drop or reset the connection.

Chapter Navigation

Every lab will contain a learning outcome section on the top. Here is an example:

Learning Objectives

Learn how to navigate this book
Open up GNS3

These will contain what the current lab is trying to teach. A topology of how the lab will look like, will be displayed after the learning outcomes. Here is an example: [caption id="attachment_21" align="aligncenter" width="500"] Figure E.1: An example scenario[/caption]

A Practical Introduction

What this book aims to accomplish is a practical understanding of the usage and functionality of Palo Alto firewalls. Learn by doing will be a strong driving force in the coming labs and examples in this book, and I encourage you to try and extend these labs and have fun with them.

1.3 SNAT

acheveldave — Sun, 08 May 2022 00:09:54 +0000

Learning Objectives

Configure Source NAT (SNAT)

Prerequisites:

Security policy for Inside to Outside
Interface configuration
Knowledge of previous labs

Scenario: Source NAT is what your router does on a daily basis to provide you with Internet access just so you can go on social media and complain about how slow your internet is. Your router at home does this all automatically for you. But since we're real network engineers with a firewall on one hand, and determination on the other. Let's learn how to configure this all by ourselves using Palo Alto! We've already configured this in the previous chapter, so let's just go over it again!

[caption id="attachment_81" align="aligncenter" width="911"] Figure 1.49: Main Scenario[/caption]

Table 1.4: Addressing Table
Device	Configuration
Clint	eth0: 10.0.0.2/24 GW: 10.0.0.1 DNS: 8.8.8.8
PaloAlto	Ethernet1/1: 10.0.0.1/24 Ethernet1/2: DHCP Management: 192.168.0.1/24
Management (WebTerm)	eth0: 192.168.0.2/24
Outside (WebTerm)	eth0: DHCP

Table 1.5: Zone Configuration
Zone	Interface
Inside	Ethernet1/1
Outside	Ethernet1/2

SNAT (Source NAT: Access the Internet in Palo Alto)

Under the policies tab, go to NAT, then click Add. [caption id="attachment_81" align="aligncenter" width="1026"] Figure 1.50: Set a Source NAT[/caption]

We want to translate packets originating from the Inside to go to the outside zone using the interface address of ethernet1/2. This would be Port Address Translation Overload. Under the General tab, just change the name.

[caption id="attachment_81" align="aligncenter" width="1026"] Figure 1.51: Set a Name for NAT[/caption]

Under the original packet tab, click add then make the source zone inside. As for the destination zone, make it outside.

[caption id="attachment_81" align="aligncenter" width="1026"] Figure 1.52: Set a Source Zone and Destination Zone for NAT[/caption] Configure these settings under the translated packet tab in the source address translation area:

Table 1.6: SNAT Configuration
Parameter	Value
Translation Type	Dynamic IP and Port
Address Type	Interface Address
Interface	Ethernet1/2
IP Address	None

[caption id="attachment_81" align="aligncenter" width="1026"] Figure 1.53: Set a Translated Packet[/caption]

Don't forget to commit!

Check Internet Connectivity on Webterm

Open up webterm, and navigate to any website of your choosing. [caption id="attachment_81" align="aligncenter" width="1026"] Figure 1.54: Verify your connectivity to the Internet[/caption] If your desired webpage showed up, you have successfully configured SNAT!

2.3 Block Files and Viruses

acheveldave — Mon, 25 Apr 2022 11:31:44 +0000

Learning Objectives

Block specific file types
Explore and "apply" advanced firewall features

Prerequisites:

SNAT for the Internet
Security policy for Inside to Outside
Interface configuration
Enable block pages
Knowledge of previous labs

Scenario: Here we will test out the file blocking, anti-malware, spyware, and spam features of Palo Alto. Sometimes we should block clients from downloading certain file types, and on top of that, implement some sort of antivirus and antispyware solution. We'll also be "testing" wildfire. A feature that thwarts new exploits from happening.

[caption id="attachment_156" align="aligncenter" width="1091"] Figure 2.41: Main scenario[/caption]

Table 2.6: Addressing Table
Device	Configuration
PaloAlto-1	management: 192.168.0.1/24 Ethernet1/1: 10.0.0.1/24 Ethernet1/2: DHCP
Client (webterm)	eth0: 10.0.0.2/24 GW: 10.0.0.1 DNS: 8.8.8.8
Management (webterm)	eth0: 192.168.0.2/24

Table 2.7: Zone Configuration
Zone	Interface
Inside	Ethernet1/1
Outside	Ethernet1/2

Create an Antivirus Profile

Under Objects > Security Profiles > Antivirus. Click on default, then Clone. [caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.42: Creating an Antivirus Profile[/caption]

Click on OK for the next window.

[caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.43: Cloning the Antivirus profile[/caption]

Select the new profile it clones (should be something like default-1).

[caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.44: Verify the Antivirus profile[/caption]

Rename the profile, and tick the option for packet capture.

[caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.45: Enable Packet Captures under Antivirus Profile[/caption] Then press OK.

Create an Anti-Spyware Profile

Under Objects > Security Profiles > Anti-Spyware. Click Add. [caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.46: Add an Anti-Spyware Profile[/caption] Under the signature policies tab, click Add, name it, then configure these:

Table 2.8: Anti-Spyware Configuration
Rule	Configuration
Medium	Action: Alert Severity: Medium, Low, Informational
HighAlert	Action: Drop Severity: Critical, High

[caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.47: Verify an Anti-Spyware Profile[/caption] Then press OK.

Create a File Blocking Profile

Under Objects > Security Profiles > File Blocking. Click Add. [caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.48: Add File blocking Profile[/caption] Configure these settings using the add button on the new window that just spawned.

Table 2.9: File Blocking Configuration
Name	Properties
PDF	Applications: any File Types: pdf, encrypted-pdf Action: Block
EXE	Applications: any File Types: exe, com Action: Block

[caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.49: Configure the File blocking profile[/caption] Then click OK.

Create a WildFire Profile

Under Objects, Security Profiles > WildFire Analysis, click Add. [caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.50: Add a WildFire Profile[/caption] Configure these settings using the add button on the new window that just spawned.

Table 2.10: WildFire Configuration
Name	Properties
Detect	Applications: any File Types: archive, jar, ms-office

[caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.51: Add a WildFire Profile[/caption] Then press OK.

Apply Security Profiles to a Security Policy

Under Polices > Security. Click the policy for inside to outside you created. [caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.52: Add a Security Policy[/caption]

Under the Actions tab, in the Profile Setting subsection. Configure these:

Table 2.11: Security Policy Actions Configuration
Parameters	Value
Profile Type	Profiles
Antivirus	Select the one you created
Anti-Spyware	Select the one you created
File Blocking	Select the one you created
WildFire Analysis	Select the one you created

[caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.53: Assigning security profiles[/caption] Then click OK. Remember to commit your changes!

Test the Security Profiles

Since I do not have a licence, we cannot demonstrate all of these profile features, as you can see when you commit. [caption id="attachment_156" align="aligncenter" width="1026"] Figure 2.54: Commit the configuration[/caption] This is ok, we can still test out the file blocking features.

On the client, navigate to a website that hosts PDF files (I used panedufiles.com).

[caption id="attachment_156" align="aligncenter" width="400"] Figure 2.55: Verify the configuration[/caption] Try and open one of these. If it shows the file blocking screen, it means that the file blocking worked! [caption id="attachment_156" align="aligncenter" width="400"] Figure 2.56: File Transfer Blocked[/caption]

3.1 Captive Portal

acheveldave — Mon, 25 Apr 2022 11:32:34 +0000

Learning Objectives

Configure VLANs
Configure captive portal

Prerequisites:

Setup Zones
Some interface configuration
Configuring VLANs on the GNS3 switch
Knowledge of previous labs

Scenario: Now let's push for some advanced networking configurations. Sometimes you just have to push departments into their own VLANs for organization and compliance. Say we have a guest and employee network. We want to prevent communication between the two as much as possible. We would also want to implement some sort of login to access the internet for guests, much like hotels.

[caption id="attachment_185" align="aligncenter" width="1073"] Figure 3.1: Main scenario[/caption]

Table 3.1: Addressing Table
Device	Configuration
PaloAlto-1	management: 192.168.0.1/24 Ethernet1/1: Trunking Ethernet1/1.10: 10.10.10.1/24 Ethernet1/1.20: 20.20.20.1/24 Ethernet1/2: DHCP
VLAN-10	eth0: 10.10.10.10/24 GW: 10.10.10.1 DNS: 8.8.8.8
VLAN-20	eth0: 20.20.20.20/24 GW: 20.20.20.1 DNS: 8.8.8.8
Management	eth0: 192.168.0.2/24
Switchy	e0: Access mode, VLAN 10 e1: Access mode, VLAN 20 e7: dot1q, VLAN 1

Table 3.2: Zone Configuration
Zone	Interface
VLAN10	Ethernet1/1.10
VLAN20	Ethernet1/1.20
Outside	Ethernet1/2

Configure Sub Interfaces

Under Network > Interfaces. Click on ethernet1/1. [caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.2: Ethernet 1/1 configuration[/caption]

In this window, we just want to set the interface type to layer 3.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.3: Set Interface type to Layer3[/caption] Then press OK.

Now while ethernet1/1 is still selected, click on add sub interface.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.4: Add Sub interfaces[/caption]

We want to add 2 sub-interfaces. Here is what you should configure:

Table 3.3: Sub Interface Configuration
Interface	Configuration
Ethernet1/1.10	Interface Name: 10 Tag: 10 Config tab: - Virtual Router: default - Security Zone: VLAN10 IPv4: - Type: Static - IP: 10.10.10.1/24
Ethernet1/1.20	Interface Name: 20 Tag: 20 Config tab: - Virtual Router: default - Security Zone: VLAN20 IPv4: - Type: Static - IP: 20.20.20.1/24

[caption id="attachment_185" align="aligncenter" width="550"] Figure 3.5: Verify Sub interfaces[/caption]

Semi-Advanced Security Policies

Well, it's not really advanced, but under Policies > Security, click Add. [caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.6: Add a Security Policy[/caption]

We will be making a policy to allow VLAN10 and VLAN20 into the Outside zone. We can do this by adding multiple zones under the source zone.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.7: Security Policy Rule - Source Zone[/caption] Then click OK.

Semi-Advanced NAT Policies

Still not really advanced. But under Policies > NAT, click Add. [caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.8: Add a NAT Policy[/caption]

We want to make a Static NAT policy for the Internet connectivity. But under the Original Packet tab, we can select multiple zones.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.9: Select the Source Zone[/caption]

Configure the rest for static NAT, then press OK.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.10: SNAT Translated Packet Tab[/caption]

Add a User

Under Device > Local User Database > Users. Click Add. [caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.11: Add Users[/caption]

Create any user you want with a username and password. Here is an example:

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.12: Add a user xav[/caption] Then click OK.

Create an Authentication Profile

Under Device > Authentication Profile, click Add. [caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.13: Add an Authentication Profile[/caption]

Under the Authentication tab, change the type to Local Database.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.14: Select Local Database[/caption]

Under the Advanced tab, add your user.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.15: Add user xav as Allow List[/caption] Then press OK.

Configure the Captive Portal

Under Device, User Identification in the Authentication Portal Settings tab, click the settings icon. [caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.16: Authentication Portal Settings[/caption] Configure these settings:

Table 3.4: Authentication Portal Configuration
Parameter	Value
Enable Authentication Portal	Tick this box
Authentication Profile	Select the one you created
Mode	Transparent

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.17: Authentication Portal Settings - Select Transparent[/caption] Then press OK.

Under Network > Zones, click on the VLAN10 zone.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.18: Select Vlan 10[/caption]

In this window, we just want to tick the Enable User Identification checkbox.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.19: Enable User Identification[/caption] Then press OK.

Finally, under Policies > Authentication. Click Add.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.20: Add an authentication Policy[/caption]

Under the Source tab, add VLAN 10 in the source zone.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.21: Add the Source Zone[/caption]

Under the Destination tab, add Outside in Destination Zone.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.22: Add the Destination Zone[/caption]

Under Actions, change the Authentication Enforcement setting, change it to default-web-form.

[caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.23: Select default-web-form[/caption] Then press OK.

Test VLANs and Captive Portal

On the VLAN-20 webterm, navigate to any website. If all was right, the desired website should appear. [caption id="attachment_185" align="aligncenter" width="1026"] Figure 3.24: Verify your configuration[/caption]

On the VLAN-10 webterm, navigate to any website. If all was right, you should see a certificate error, accept this. Then you should see a login page.

[caption id="attachment_185" align="aligncenter" width="400"] Figure 3.25: Login Page[/caption] Enter your credentials and log in. If all was successful, you should see the website appear. [caption id="attachment_185" align="aligncenter" width="400"] Figure 3.26: Verify your configuration[/caption]

3.2 Remote Access VPN

acheveldave — Mon, 25 Apr 2022 11:32:46 +0000

Learning Objectives

Configure a tunnel interface
Configure a remote access VPN

Prerequisites:

Setup Zones
Some interface configuration
Create a new user
Create an auth policy
Policy that allows VPN to Inside
Policy that allows Outside to VPN
Knowledge of previous labs

Scenario: VPNs aren't just about changing your location like many advertisements say they're for. What it's really used for is to securely access a remote location's resources like your workplace, or even your own home. That is what this lab will focus on. We are going to install GlobalProtect Agent on Kali and then we'll try to reach the Internal through VPN connection.

[caption id="attachment_214" align="aligncenter" width="990"] Figure 3.27: Main scenario[/caption]

Table 3.5: Addressing Table
Device	Configuration
PaloAlto-1	management: 192.168.0.1/24 Ethernet1/1: 10.0.0.1/24 Ethernet1/2: DHCP
Internal (WordPress)	eth0: 10.0.0.2/24 GW: 10.0.0.1
KaliLinux2019.3-1	eth0: DHCP
Management	eth0: 192.168.0.2/24

Table 3.6: Zone Configuration
Zone	Interface
Inside	Ethernet1/1
Outside	Ethernet1/2
VPN	Tunnel.1

Create a Tunnel Interface

Under Network > Interfaces in the Tunnel tab, click Add. [caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.28: Creating a Tunnel[/caption]

In the new window, change the virtual router to default, and the security zone to the VPN zone.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.29: Tunnel Interface[/caption] Then click OK.

Enable User ACL for a Zone

Under Network > Zone, click the VPN zone. [caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.30: Create a VPN Zone[/caption]

Tick the Enable user identification box.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.31: Enable User Identification under VPN Zone[/caption] Then press OK.

Generate Certs

Under Device > Certificate Management > Certificates, click on Generate. [caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.32: Generate a certificate[/caption] Configure these settings in the new window:

Table 3.7: Certificate Generation
Parameters	Value
Certificate Name	Cert Name Here
Common Name	The DHCP IP of Ethernet1/2
Certificate Authority	Tick this box

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.33: Generate a certificate[/caption] Then click Generate.

Create an SSL/TLS Service Profile

Under Device > Certificate Management > SSL/TLS Service Profile, click Add. [caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.34: Add SSL/TLS Service Profile[/caption]

In the new window, add the certificate you generated.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.35: Configure SSL/TLS Service Profile[/caption] Then click OK.

Create a GlobalProtect Portal

Under Network > GlobalProtect > Portals, then click Add. [caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.36: Add a Portal[/caption]

In the general tab, set the interface to Ethernet1/2.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.37: GlobalProtect Portal Configuration[/caption]

In the authentication tab, select SSL/TLS profile you created in the previous step, then click Add.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.38: Adding SSL/TLS Profile[/caption]

In the new window, change the authentication profile, then press OK.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.39: Adding Authentication Profile[/caption]

In the agent tab, in the agent section, click Add.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.40: Adding the agent[/caption]

In the internal tab in the Internal gateway, click Add.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.41: Configure Internal Gateway[/caption]

In this window, change the Address to select IP, and in the IPv4 box, type in the IP of Ethernet1/2.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.42: Set the IP address for Internal Gateway[/caption]

Press OK twice to get back to the agent tab. Then in the trusted root ca section, add your generated cert, and tick the box to install in local root certificate store.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.43: Add the Root CA certificate[/caption] Then press OK.

Create a GlobalProtect Gateway

Under Network > GlobalProtect > Gateways, click Add. [caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.44: Add a Gateway[/caption]

In the general tab, set the interface to Ethernet1/2.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.45: GlobalProtect Gateway Configuration[/caption]

In the Authentication tab, add your SSL/TLS profile, then click Add.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.46: SSL/TLS Service Profile[/caption]

In the new window, select your authentication profile, then click OK.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.47: Authentication Profile[/caption]

Under the agent tab, in tunnel settings, tick the tunnel mode checkbox and select the tunnel you made.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.48: Tunnel Mode and Interface[/caption]

In client settings, click Add.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.49: Client Settings[/caption]

Make sure the Any checkbox is ticked on top of the OS category, then press OK.

[caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.50: Select Client as Any[/caption]

In client IP pool settings, add an IP pool range of this:

172.16.10.1-172.16.10.10 [caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.51: IP Pool Configuration[/caption] Then press OK. Don't forget to commit the configuration!

Install the GlobalProtect Client on Kali

Open up a terminal window and run the following commands:

#curl -L https://bit.ly/32Ljx1y --output GP.deb #sudo dpkg -i GP.deb #globalprotect connect -p [IP of Palo Alto Ethernet1/2 Here]

When connecting, it will show an error about validation. Type in y then press enter. It will also ask for your username and password. Enter the one you created prior. [caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.52: Installing GlobalProtect on Kali Linux[/caption]

Test Remote Access VPN

On Kali, after connecting to GlobalProtect, navigate to the IP of the WordPress Server (Internal). [caption id="attachment_214" align="aligncenter" width="1026"] Figure 3.53: Verify your configuration[/caption] If everything was correct, it should display the WordPress site!

3.3 Site-to-Site VPN

acheveldave — Mon, 25 Apr 2022 11:33:20 +0000

Learning Objectives

Configure site-to-site VPN
Configure static routing

Prerequisites:

Create Zones on both firewalls
Create a tunnel interface on both firewalls
Create a policy to allow VPN to Inside on both firewalls
Create a policy to allow Inside to VPN on both firewalls
Interface configuration
Knowledge of previous labs

Scenario: This one is a bit tricky since you will be managing both devices. A site-to-site VPN is what your company would set up if you had offices in other locations without being directly connected to each other. But in this lab, we'll just take it easy and assume that they have a direct connection to each other. So, we are going to configure site-to-site VPN between two Palo Alto firewalls. Then, you should be able to ping from client-1 to client-2.

[caption id="attachment_227" align="aligncenter" width="600"] Figure 3.54: Main scenario[/caption]

Table 3.8: Addressing Table
Device	Configuration
Site-1	management: 192.168.0.1/24 Ethernet1/1: 10.0.0.1/24 Ethernet1/2: 1.1.1.1/24
Site-2	management: 192.168.0.2/24 Ethernet1/1: 172.16.10.1/24 Ethernet1/2: 1.1.1.2/24
Site1-Client	eth0: 10.0.0.2/24 GW: 10.0.0.1
Site2-Client	eth0: 172.16.10.2/24 GW: 172.16.10.1
Management1	eth0: 192.168.0.3/24

Table 3.9: Zone Configuration for Site1
Zone	Interface
Inside	Ethernet1/1
VPN	Ethernet1/2, tunnel.1

Table 3.10: Zone Configuration for Site2
Zone	Interface
Inside	Ethernet1/1
VPN	Ethernet1/2, tunnel.1

Create an IKE Gateway

Under Network > Network Profiles > IKE Gateways, click Add. [caption id="attachment_227" align="aligncenter" width="1026"] Figure 3.55: Add an IKE Gateway[/caption]

On the Site1 firewall, configure these settings:

Table 3.11: Site1 IKE Gateway Configuration
Parameter	Value
Interface	Ethernet1/2
Local IP Address	1.1.1.1/24
Peer IP Address Type	IP
Peer Address	1.1.1.2
Pre-shared Key	Password Here
Confirm Pre-shared key	Confirm Password Here

[caption id="attachment_227" align="aligncenter" width="600"] Figure 3.56: Site1 Firewall: IKE Gateway Configuration[/caption] Then press OK.

On the Site2 firewall, configure these settings:

Table 3.12: Site2 IKE Gateway Configuration
Parameters	Value
Interface	Ethernet1/2
Local IP Address	1.1.1.2/24
Peer IP Address Type	IP
Peer Address	1.1.1.1
Pre-shared Key	Same Password as before here
Confirm Pre-shared key	Confirm same password as before here

[caption id="attachment_227" align="aligncenter" width="600"] Figure 3.57: Site2 Firewall: IKE Gateway Configuration[/caption] Then press OK.

Create an IPsec Tunnel

Under Network > IPsec Tunnel, click Add. [caption id="attachment_227" align="aligncenter" width="1026"] Figure 3.58: Site1 Firewall: Add an IPsec Tunnel[/caption]

On both firewalls, configure these settings:

Table 3.13: IPsec Tunnel Configuration
Parameters	Value
Tunnel Interface	tunnel.1
IKE Gateway	The one you created on the respective firewall

[caption id="attachment_227" align="aligncenter" width="1026"] Figure 3.59: Site1 and Site2 Firewall: IPsec Tunnel Configuration[/caption]

Create Static Routes

Under Network > Virtual Routers, click default. [caption id="attachment_227" align="aligncenter" width="1026"] Figure 3.60: Virtual Routers Configuration[/caption]

Under the static routes tab, click Add.

[caption id="attachment_227" align="aligncenter" width="1026"] Figure 3.61: Add a Static Route in the Site1[/caption]

On the Site1 firewall, configure these settings:

Table 3.14: Site1 Static Route Configuration
Parameters	Value
Destination	172.16.10.0/24
Interface	tunnel.1
Next Hop	None

[caption id="attachment_227" align="aligncenter" width="1026"] Figure 3.62: Static Route Configuration in the Site1[/caption]

On the Site2 firewall, configure these settings:

Table 3.15: Site2 Static Route Configuration
Parameters	Value
Destination	10.0.0.0/24
Interface	tunnel.1
Next Hop	None

[caption id="attachment_227" align="aligncenter" width="1026"] Figure 3.63: Static Route Configuration in the Site 2[/caption] Then press OK.

Test the Site-to-Site

On any client device, try and ping the other client on the other site. [caption id="attachment_227" align="aligncenter" width="1026"] Figure 3.64: Verify your configuration[/caption] If you can ping the other client in the other site, everything worked!

4.1 IPsec VPN between Palo Alto on Premise and Microsoft Azure

acheveldave — Sat, 30 Apr 2022 19:25:24 +0000

Learning Objectives

Configure a Virtual Network in Microsoft Azure
Set up and configure the Azure VPN Gateway for IPsec VPN
Implement Network Security Groups (NSGs) in Azure for traffic control
Monitor and troubleshoot IPsec VPN connections on Palo Alto

Scenario: We are going to connect on-premise Palo Alto to Azure Virtual Gateway. This is going to be IPsec VPN between Palo Alto and Azure. First, we'll configure Azure and then connect Palo Alto through Port1 to Azure Virtual Gateway.

[caption id="attachment_274" align="aligncenter" width="1173"] Figure 4.1: Main scenario[/caption]

Azure Configuration

Create a resource group in Azure as follows:
- Resource group: Pal
- Region: West US
[caption id="attachment_234" align="aligncenter" width="1103"] Figure 4.2: Create a resource group[/caption] [caption id="attachment_234" align="aligncenter" width="500"] Figure 4.3: Create a resource group[/caption] [caption id="attachment_234" align="aligncenter" width="500"] Figure 4.4: Create a resource group[/caption]
Create a virtual network as follows:
- Resource group: Pal
- Name: Azure-Pal
- Region: West US
- Change the default subnet: 10.0.1.0/24
[caption id="attachment_239" align="aligncenter" width="1072"] Figure 4.5: Create a virtual network[/caption] [caption id="attachment_239" align="aligncenter" width="1880"] Figure 4.6: Create a virtual network (Change default subnet)[/caption] [caption id="attachment_239" align="aligncenter" width="500"] Figure 4.7: Create a virtual network[/caption] [caption id="attachment_239" align="aligncenter" width="500"] Figure 4.8: Create a virtual network[/caption] [caption id="attachment_239" align="aligncenter" width="500"] Figure 4.9: Create a virtual network[/caption]
Create a virtual network gateway as following:
- Name: Azure-VPN-Pal
- Region: West US
- Generation: Generation1
- Gateway subnet address range: 10.0.0.0/24
- Public IP address name: AzurePublic
Click on Create and Review. It takes around 25 minutes to deploy a virtual network gateway in Azure. [caption id="attachment_245" align="aligncenter" width="500"] Figure 4.10: Create a virtual network gateway[/caption] [caption id="attachment_245" align="aligncenter" width="500"] Figure 4.11: Create a virtual network gateway[/caption] [caption id="attachment_245" align="aligncenter" width="500"] Figure 4.12: Create a virtual network gateway[/caption] [caption id="attachment_245" align="aligncenter" width="400"] Figure 4.13: Create a virtual network gateway[/caption] [caption id="attachment_245" align="aligncenter" width="1317"] Figure 4.14: Create a virtual network gateway (deployment)[/caption] [caption id="attachment_245" align="aligncenter" width="1075"] Figure 4.15: Deployment of virtual network gateway[/caption]
Create a local network gateway as follows:
- Resource Group: Pal
- Region: West US
- Name: PaloAlto
- IP Address: IP_Address_of_Port1_FortiGate(On Prem)
- Address Space: IP_Address_LocalNetwork
[caption id="attachment_249" align="aligncenter" width="400"] Figure 4.16: Create a local network gateway[/caption] [caption id="attachment_249" align="aligncenter" width="400"] Figure 4.17: Create a local network gateway[/caption] [caption id="attachment_249" align="aligncenter" width="400"] Figure 4.18: Create a local network gateway (review + create)[/caption] [caption id="attachment_249" align="aligncenter" width="819"] Figure 4.19: Verify local network gateway deployment[/caption]
Go to Virtual network gateway and create a connection in Virtual network gateways > Azure-VPN-Pal > connections > Add [caption id="attachment_251" align="aligncenter" width="250"] Figure 4.20: Connection configuration[/caption] Based on the Microsoft article “About cryptographic requirements and Azure VPN gateways”, by default, integrity is SHA384, SHA256, SHA1, MD5, and encryption is AES256, AES192, AES128, DES3, DES. So, we'll select SHA1 and AES128 in FortiGate. After doing this step, you should receive a Public IP address in the Overview tab. [caption id="attachment_251" align="aligncenter" width="1539"] Figure 4.21: Verify the public IP address[/caption]

Palo Alto Configuration

First, we'll configure Ports IP address. [caption id="attachment_257" align="aligncenter" width="652"] Figure 4.22: Ethernet 1/1 Config[/caption] [caption id="attachment_257" align="aligncenter" width="657"] Figure 4.23: Ethernet 1/1 IPV4[/caption] [caption id="attachment_257" align="aligncenter" width="666"] Figure 4.24: Ethernet 1/2 Config[/caption] [caption id="attachment_257" align="aligncenter" width="668"] Figure 4.25: Ethernet 1/2 IPv4[/caption] Then, create a tunnel. [caption id="attachment_257" align="aligncenter" width="670"] Figure 4.26: Create a tunnel 1[/caption] [caption id="attachment_257" align="aligncenter" width="691"] Figure 4.27: Verify Tunnel1[/caption] Then, commit the configuration!
Create a static route to tunnel1 and ethernet1/1 as following figures. Traffic related to 10.0.0.0/16 should go through the tunnel. The rest of the traffic should go through the default Gateway. [caption id="attachment_259" align="aligncenter" width="500"] Figure 4.28: Create a static route to ethernet 1/1[/caption] [caption id="attachment_259" align="aligncenter" width="500"] Figure 4.29: Create a static route to tunnel.1[/caption]
Go to Network > Network Profiles > Create an IKE Crypto. [caption id="attachment_260" align="aligncenter" width="500"] Figure 4.30: Create an IKE Crypto Profile[/caption]
Go to Network > Network Profiles > Create an IPsec Crypto Profile. [caption id="attachment_261" align="aligncenter" width="500"] Figure 4.31: Create an IPsec Crypto Profile[/caption]
Go to Network > Network Profiles > Create an IKE Crypto Gateways. [caption id="attachment_263" align="aligncenter" width="500"] Figure 4.32: Create an IKE Gateway[/caption] [caption id="attachment_263" align="aligncenter" width="500"] Figure 4.33: Select IKE Crypto Profile[/caption]
Go to Network > IPsec Tunnels > Add. Select the previous profile you have created as Figure 4.34. [caption id="attachment_264" align="aligncenter" width="500"] Figure 4.34: Create an IPsec Tunnel[/caption]
Create a firewall policy from LAN to VPN zone and from VPN to LAN. [caption id="attachment_270" align="aligncenter" width="1342"] Figure 4.35: Create a security policy "LAN-AZ"[/caption] [caption id="attachment_270" align="aligncenter" width="1339"] Figure 4.36: Create a security policy "LAN-AZ." Select the source zone as LAN.[/caption] [caption id="attachment_270" align="aligncenter" width="1344"] Figure 4.37: Create a security policy "LAN-AZ." Select destination zone as VPN.[/caption] [caption id="attachment_270" align="aligncenter" width="1342"] Figure 4.38: Create a security policy "AZ-LAN"[/caption] [caption id="attachment_270" align="aligncenter" width="1345"] Figure 4.39: Create a security policy "AZ-LAN." Select source zone as VPN.[/caption] [caption id="attachment_270" align="aligncenter" width="1339"] Figure 4.40: Create a security policy "AZ-LAN." Select destination zone as LAN.[/caption] Don't forget to commit the configuration!

Verify Connections

If you navigate to IPsec Tunnel, the status should be up. [caption id="attachment_274" align="aligncenter" width="1281"] Figure 4.41: Verify IPsec Tunnel[/caption] [caption id="attachment_274" align="aligncenter" width="500"] Figure 4.42: Verify connections in Azure[/caption] [caption id="attachment_274" align="aligncenter" width="500"] Figure 4.43: Verify ping from Windows to webterm[/caption] [caption id="attachment_274" align="aligncenter" width="500"] Figure 4.44: Verify ping from webterm to Windows in Azure[/caption]

4.2 Deploy Palo Alto to Azure

acheveldave — Mon, 16 May 2022 23:05:10 +0000

Learning Objectives

Configure a Virtual Network in Microsoft Azure
Set up and configure the Azure VPN Gateway for IPsec VPN
Implement Network Security Groups (NSGs) in Azure for traffic control
Monitor and troubleshoot IPsec VPN connections on Palo Alto

Scenario: In this lab, we'll learn how to deploy Palo Alto Firewall to Azure.

Go to Azure Marketplace and search for Palo Alto. [caption id="attachment_277" align="aligncenter" width="820"] Figure 4.45: Search for Palo Alto[/caption]
Select VM-Series Next-Generation Firewall from Palo Alto. [caption id="attachment_278" align="aligncenter" width="1493"] Figure 4.46: Select VM Series Next-Generation Firewall[/caption]
Then, Select VM-Series Next Generation Firewall from dropdown list. [caption id="attachment_279" align="aligncenter" width="1304"] Figure 4.47: Select VM-Series Next Generation Firewall[/caption]
Create a Firewall information, as Figure 4.48. [caption id="attachment_282" align="aligncenter" width="1099"] Figure 4.48: Create a VM-Series Palo Alto[/caption] [caption id="attachment_282" align="aligncenter" width="772"] Figure 4.49: Networking configuration[/caption] [caption id="attachment_282" align="aligncenter" width="768"] Figure 4.50: VM Configuration (DNS-VM Name)[/caption]
Leave other tabs as default and press on "Review + create." It will validate your information and then you can create a Palo Alto Firewall. [caption id="attachment_283" align="aligncenter" width="784"] Figure 4.51: Create a firewall[/caption]
Then, it will start deployment of Palo Alto. It takes around 5 minutes to deploy Palo Alto. [caption id="attachment_285" align="aligncenter" width="813"] Figure 4.52: Deployment is in progress[/caption] [caption id="attachment_285" align="aligncenter" width="812"] Figure 4.53: Deployment is complete[/caption]
After deployment is completed, go to Resource group > hamid > Overview and look for Palo Alto Public IP address. [caption id="attachment_287" align="aligncenter" width="903"] Figure 4.54: Palo Alto Public IP Address[/caption] [caption id="attachment_287" align="aligncenter" width="1210"] Figure 4.55: Palo Alto Public IP Address[/caption]
Type the IP address in the browser. You should be able to see the Palo Alto credentials page. Enter your username and password to log in to the firewall. [caption id="attachment_288" align="aligncenter" width="1639"] Figure 4.56: Palo Alto Firewall Credential Page[/caption]
Azure will create three interfaces, as Figure 4.57. By default, Eth0 is set as a management port and this port has the public IP address and you can reach the GUI through this IP address. Eth1 is set as an Untrusted interface and to be able to access the firewall through this port, you should set the Public address for this port. [caption id="attachment_289" align="aligncenter" width="400"] Figure 4.57: Palo Alto Firewall Interfaces by default[/caption]
To set interfaces in the firewall, you should go to Network > Interfaces and set both ethernet1/1 and ethernet1/2 as a DHCP client. Also, uncheck "Automatically create default route pointing to default gateway." [caption id="attachment_291" align="aligncenter" width="500"] Figure 4.58: Ethernet1/1 configuration[/caption] [caption id="attachment_291" align="aligncenter" width="500"] Figure 4.59: Ethernet1/2 configuration[/caption]
Then, you set a default route and set a zone for each interface. [caption id="attachment_294" align="aligncenter" width="922"] Figure 4.60: Ethernet1/1 zone and virtual router[/caption] [caption id="attachment_294" align="aligncenter" width="917"] Figure 4.61: Ethernet1/2 zone and virtual router[/caption]
and then in Ethernet1/1 under the advanced tab, set management interface profile as Figure 4.62.
[caption id="attachment_294" align="aligncenter" width="500"] Figure 4.62: Ethernet1/1 Management Profile[/caption]
Create a static route to 10.0.1.1. [caption id="attachment_295" align="aligncenter" width="400"] Figure 4.63: Create a static route to 10.0.1.1[/caption]
Create a public IP address and assign the public IP address to interface eth1 (Untrusted interface). [caption id="attachment_299" align="aligncenter" width="500"] Figure 4.64: Create a public IP address[/caption] [caption id="attachment_299" align="aligncenter" width="350"] Figure 4.65: Create a public IP address (set SKU and name)[/caption] [caption id="attachment_299" align="aligncenter" width="700"] Figure 4.66: Select Interface eth1[/caption] [caption id="attachment_299" align="aligncenter" width="400"] Figure 4.67: Assign public IP address to Eth1[/caption]
Open the browser and type the public IP address. You should be able to access the firewall.

4.3 Site-to-Site VPN between Palo Alto on Premise and Palo Alto in the Azure

acheveldave — Wed, 18 May 2022 01:56:19 +0000

Learning Objectives

Configure a Virtual Network in Microsoft Azure
Set up and configure the Azure VPN Gateway for IPsec VPN
Implement Network Security Groups (NSGs) in Azure for traffic control
Monitor and troubleshoot IPsec VPN connections on Palo Alto

Scenario: In this lab, we will create a site-to-site VPN from Palo Alto on-premise to Palo Alto in the Azure. Knowing the configuration of section 4.2 is necessary for this lab. I have created management and ethernet1/1 as a DHCP, so they will receive an IP address from Cloud.

[caption id="attachment_302" align="aligncenter" width="1510"] Figure 4.68: Main scenario[/caption]

On-Premise Palo Alto Configuration

Devices	Interface	IP address
Palo Alto	Management	DHCP Client
	Ethernet 1/1	DHCP Client
	Ethernet 1/2	192.168.10.1/24
WebTerm	Eth0	192.168.10.2/24

Configure the interfaces of the firewall. Set Ethernet1/1 as a Untrust Zone and Ethernet1/2 as a Trust Zone. [caption id="attachment_303" align="aligncenter" width="1447"] Figure 4.69: Firewall Interfaces[/caption]
Create a tunnel.1 and set the tunnel as Untrust zone. [caption id="attachment_304" align="aligncenter" width="1190"] Figure 4.70: Create a tunnel[/caption]
Create two static routes, one pointing to 142.232.197.254 (on-Prem Default Gateway) and the other one sending the traffic of Azure through the tunnel. [caption id="attachment_306" align="aligncenter" width="500"] Figure 4.71: Create a static route to default gateway[/caption] [caption id="attachment_306" align="aligncenter" width="500"] Figure 4.72: Create a static route to Azure[/caption]
For setting up, site-to-site VPN we will use default IKE Crypto, IPsec Crypto profiles and we will only set IKE Gateway and IPsec Tunnel as following figures. You have to configure local and peer identification. [caption id="attachment_308" align="aligncenter" width="450"] Figure 4.73: Create an IKE Gateway[/caption] [caption id="attachment_308" align="aligncenter" width="500"] Figure 4.74: Create an IPsec Tunnel[/caption]
Finally, create two security policies, one from Trust to Untrust zone and the other from Untrust to Trust zone. [caption id="attachment_309" align="aligncenter" width="1420"] Figure 4.75: Create two security policies[/caption]

Azure Configuration

Create a Palo Alto firewall in Azure and configure the interfaces. You need to do all steps in section 4.1 and assign public IP address to Ethernet 1 (Untrust Zone).
Create a route in Azure pointing to Trust interface. [caption id="attachment_316" align="aligncenter" width="500"] Figure 4.76: Create a route table[/caption] [caption id="attachment_316" align="aligncenter" width="500"] Figure 4.77: Create a route table[/caption] [caption id="attachment_316" align="aligncenter" width="500"] Figure 4.78: Create a route table (verify and create)[/caption] [caption id="attachment_316" align="aligncenter" width="500"] Figure 4.79: Add a Route[/caption] [caption id="attachment_316" align="aligncenter" width="500"] Figure 4.80: Add a default route pointing to 10.0.2.4 (Trust Interface)[/caption] [caption id="attachment_316" align="aligncenter" width="500"] Figure 4.81: Associate Trust route to Trust Subnet[/caption] [caption id="attachment_316" align="aligncenter" width="500"] Figure 4.82: Associate fwVNET to Trust Subnet[/caption]
Set static routes as figures 4.83 and 4.84. [caption id="attachment_318" align="aligncenter" width="500"] Figure 4.83: Static route pointing to default gateway[/caption] [caption id="attachment_318" align="aligncenter" width="500"] Figure 4.84: Static route pointing to tunnel[/caption]
For setting up, site-to-site VPN we will use default IKE Crypto, IPsec Crypto profiles and we will only set IKE Gateway and IPsec Tunnel as figures 4.85 and 4.86. [caption id="attachment_320" align="aligncenter" width="500"] Figure 4.85: Create an IKE Gateway[/caption] [caption id="attachment_320" align="aligncenter" width="500"] Figure 4.86: Create an IPsec Tunnel[/caption]
Finally, create two security policies, one from Trust to Untrust zone and the other from Untrust to Trust zone. [caption id="attachment_321" align="aligncenter" width="800"] Figure 4.87: Create two security policies[/caption]
Add windows or Linux VM to Trust Subnet. This VM is for testing ping from Azure side to on-prem. We will not create a public IP address for the VM. [caption id="attachment_323" align="aligncenter" width="500"] Figure 4.88: Create a VM[/caption] [caption id="attachment_323" align="aligncenter" width="500"] Figure 4.89: Assign Trust subnet with no public IP[/caption]
Now, you should be able to ping and your tunnel should be green. [caption id="attachment_326" align="aligncenter" width="500"] Figure 4.90: Ping from WebTerm to Azure[/caption] [caption id="attachment_326" align="aligncenter" width="500"] Figure 4.91: Ping from Azure to WebTerm[/caption] [caption id="attachment_326" align="aligncenter" width="1073"] Figure 4.92: Tunnel Status[/caption]

Capstone Project

acheveldave — Mon, 25 Apr 2022 11:35:54 +0000

[caption id="attachment_330" align="aligncenter" width="993"] Figure C.1: Capstone Topology[/caption] Well, this is it. The final lab. This will test everything you have learned so far and maybe some more. I will list the requirements and come up with a scenario below. I will not be providing IP addresses or zone information. If you can meet the requirements below, you can consider yourself pretty good at Palo Alto. Good luck!

Scenario: ODI (Openly Deceptive Insurance) is a company looking for a consultant to do all their networking. They have 2 office locations, one in Vancouver, and the other one in England. In the Vancouver site, they want 2 VLANs, VLAN 10 and VLAN 20. VLAN 20 will serve as a login only network, whereas VLAN 10 is for all the employees. Vancouver also hosts their internal webserver where they keep internal records of very important things like their next scam, and list of really good Netflix shows. They also have a site-to-site setup with their England site to access their other resources. But that site-to-site is mainly so that the Vancouver employees have access to British Netflix. The England site is responsible for hosting the public webserver in the DMZ, as well as being the main source of remote access employees so they can access the internal webserver by connecting to the England site online.

Requirements

"Vancouver Site":

VLAN Configuration
Captive Portal on VLAN 20
DHCP Server to provide addressing for VLAN 10 and VLAN 20
Access Internet through Site to Site VPN
Site to Site VPN

"England Site":

Secure DMZ for DMZ webserver
DoS protection for "public" facing interface
Site to Site VPN
Remote Access VPN
Internet Access

Video Guide

This video will go over how I set it up and maybe some other additional tips and tricks. Download Captions [embed]https://www.youtube.com/embed/pRDjbaYTjX8[/embed]

Access Denied

acheveldave — Wed, 29 Nov 2023 00:03:09 +0000

Chapter 1. Basics

acheveldave — Sat, 12 Mar 2022 02:56:28 +0000

Chapter 2. Security Tuneup

acheveldave — Mon, 25 Apr 2022 11:30:53 +0000

Chapter 3. Advanced Networking

acheveldave — Mon, 25 Apr 2022 11:32:17 +0000

Chapter 4. Cloud Technologies

acheveldave — Mon, 02 May 2022 19:22:32 +0000

Capstone Project

acheveldave — Mon, 25 Apr 2022 11:33:33 +0000

H5P listing

bpayne — Wed, 29 Nov 2023 00:06:55 +0000