Configuring a Palo Alto Networks firewall can range from a basic internet-edge deployment to a complex multi-site environment. Here's a practical walkthrough of the core configuration process for a new firewall.
Recommended Configuration Order
- Management settings
- Licensing and software updates
- Interfaces
- Zones
- Virtual router
- Routes
- NAT
- Address and service objects
- Security policies
- Security profiles
- User-ID
- Logging
- VPNs (if needed)
- High availability (if needed)
- Commit and validate
1. Perform Initial Setup
Connect to the firewall's management interface.
-
Default management IP:
192.168.1.1 -
Default username:
admin -
Default password:
admin
After logging in:
- Change the administrator password.
-
Configure:
- Management IP address
- Netmask
- Default gateway
- DNS servers
- NTP servers
- Configure licensing if the firewall has subscriptions.
- Update the PAN-OS software if appropriate.
Commit the changes.
2. Configure Interfaces
Assign interfaces to zones and virtual routers.
Example:
| Interface | Purpose | Zone | Virtual Router |
|---|---|---|---|
| ethernet1/1 | Internet | Untrust | default |
| ethernet1/2 | Internal LAN | Trust | default |
Configure each interface with either:
- Layer 3
- Layer 2
- Virtual Wire
- Tap
- HA
Most deployments use Layer 3.
Assign:
- IP address
- Zone
- Virtual Router
3. Create Security Zones
Typical zones include:
- Trust
- Untrust
- DMZ
- Guest
- VPN
Zones determine how security policies are applied.
4. Configure a Virtual Router
Add routes.
Example:
Default route:
Destination: 0.0.0.0/0 Next Hop: ISP Gateway
Also configure internal routes if needed.
5. Configure NAT
Typical outbound internet rule:
Original
Source Zone: Trust Destination Zone: Untrust Source Address: Any Destination Address: Any
Translated
Dynamic IP and Port Interface Address ethernet1/1
6. Configure Security Policies
Example Allow Internet
Source
Zone: Trust Address: Any
Destination
Zone: Untrust Address: Any
Application
web-browsing ssl dns ntp
Service
application-default
Action
Allow
Enable logging at session end.
7. Configure Objects
Create reusable objects such as:
Addresses
Server01 192.168.10.25
Address Groups
Domain Controllers Web Servers
Service Objects
TCP 443 TCP 8443 UDP 53
8. Configure Security Profiles
Attach profiles to security rules.
Typical profiles:
- Antivirus
- Anti-Spyware
- Vulnerability Protection
- WildFire Analysis
- URL Filtering
- DNS Security (licensed)
- File Blocking
- Data Filtering
Many organizations begin with Palo Alto's Best Practice profile groups.
9. Configure Logging
Send logs to:
- Local logs
- Panorama
- Syslog
- SIEM
- Cortex Data Lake
Configure log forwarding profiles.
10. Configure User Identification
Enable User-ID.
Configure:
- Active Directory integration
- LDAP
- Kerberos
- GlobalProtect
- User-ID Agents
This enables policies like:
Engineering -> Internet HR -> Payroll Executives -> SaaS
instead of relying solely on IP addresses.
11. Configure App-ID Policies
Rather than allowing ports, allow applications.
Example:
Allow
- web-browsing
- ssl
- office365
- zoom
- teams
Block
- bittorrent
- tor
- unknown-tcp
- unknown-udp
12. Configure Decryption (Optional)
SSL Forward Proxy
- Generate a CA certificate.
- Deploy the CA certificate to client devices.
- Enable decryption policy.
- Exclude sensitive categories (e.g., banking, healthcare) as appropriate.
This allows inspection of encrypted traffic while respecting organizational policy and privacy requirements.
13. Configure High Availability (Optional)
Configure:
- HA1 control link
- HA2 data link
- Active/Passive or Active/Active
- Synchronization settings
Verify failover functionality.
14. Test
Verify:
- Internet access
- DNS resolution
- NAT translations
- Security policy matches
- Logging
- User-ID
- Threat prevention
- Application identification
Useful CLI commands:
show interface all show routing route show session all show jobs all show high-availability state test security-policy-match \ source 192.168.1.10 \ destination 8.8.8.8 \ protocol 6 \ destination-port 443
15. Commit Changes
Configuration changes are not active until committed.
Use:
Commit
or, in the CLI:
commit
Always review the commit output for warnings or errors.
Recommended Configuration Order
- Management settings
- Licensing and software updates
- Interfaces
- Zones
- Virtual router
- Routes
- NAT
- Address and service objects
- Security policies
- Security profiles
- User-ID
- Logging
- VPNs (if needed)
- High availability (if needed)
- Commit and validate
For production deployments, Palo Alto Networks also recommends following the "Best Practice Assessment" guidance, which emphasizes least-privilege security policies, use of App-ID and User-ID, attaching threat prevention profiles to allow rules, and enabling comprehensive logging to maximize the firewall's next-generation security capabilities.
No comments:
Post a Comment