PALO ALTO FIREWALL – INITIAL CONFIGURATION

 

PALO ALTO FIREWALL – INITIAL CONFIGURATION  

📌 1. Console Access

• Connect via Console Cable
• Default Login:
  • Username: admin
  • Password: admin
• Change default password immediately.

---

📌 2. Configure Management Interface

configure

set deviceconfig system ip-address 192.168.1.10
set deviceconfig system netmask 255.255.255.0
set deviceconfig system default-gateway 192.168.1.1
set deviceconfig system dns-setting servers primary 8.8.8.8
set deviceconfig system dns-setting servers secondary 1.1.1.1

commit

---

📌 3. Access Web GUI

https://192.168.1.10

---

📌 4. Configure Hostname

Device > Setup > Management

Example:

PA-HQ-01

---

📌 5. Configure NTP

Device
  Setup
    Services

Example:

time.google.com
pool.ntp.org

---

📌 6. Configure Time Zone

Device
  Setup
    Management

Example:

US/Eastern

---

📌 7. Configure DNS

Primary:

8.8.8.8

Secondary:

1.1.1.1

---

📌 8. Configure Licensing

Device
  Licenses

Retrieve licenses using:

• Support Portal Account
• Auth Code

---

📌 9. Dynamic Updates

Device
  Dynamic Updates

Update:

• Applications
• Threats
• Antivirus
• WildFire
• URL Filtering

---

📌 10. Create Security Zones

Example:

Trust
Untrust
DMZ
Guest
VPN
Management

---

📌 11. Configure Interfaces

Example:

Ethernet1/1

Layer3
Zone: Untrust
Virtual Router: default

Ethernet1/2

Layer3
Zone: Trust

---

📌 12. Assign IP Addresses

Example

WAN

203.0.113.2/30

LAN

192.168.10.1/24

---

📌 13. Configure Virtual Router

Network
  Virtual Routers

Add Interfaces:

• ethernet1/1
• ethernet1/2

---

📌 14. Configure Static Default Route

Destination:
0.0.0.0/0

Next Hop:
ISP Gateway

---

📌 15. Configure Source NAT

Original Zone:
Trust

Destination Zone:
Untrust

Translation:
Dynamic IP and Port

---

📌 16. Create Security Policies

Allow:

Trust → Untrust

Deny:

Any → Any

(Implicit deny already exists.)

---

📌 17. Configure DHCP Server (Optional)

Network
  DHCP

Example Pool:

192.168.10.100
to
192.168.10.200

Gateway:

192.168.10.1

DNS:

8.8.8.8

---

📌 18. Configure Administrative Access

Create named admin accounts.

Avoid using:

admin

Use:

• Role-Based Access
• Strong Passwords
• MFA (if available)

---

📌 19. Configure Logging

Enable logging for:

• Security Rules
• NAT
• System
• Configuration

Forward logs to:

• Syslog
• SIEM
• Panorama

---

📌 20. Save Configuration

Commit

Then:

Device
  Setup
    Operations

Save Named Configuration Snapshot

---

📌 21. Verify Connectivity

CLI:

ping host 8.8.8.8

ping source 192.168.10.1 host 8.8.8.8

---

📌 22. Useful CLI Commands

Show Interfaces

show interface all

Show Routing Table

show routing route

Show ARP

show arp all

Show Sessions

show session all

Show System Info

show system info

Commit

commit

---

✅ Recommended Initial Build Order

1. Change Admin Password
2. Configure Management IP
3. Configure Hostname
4. Configure DNS
5. Configure NTP
6. Configure Time Zone
7. Install Licenses
8. Update Dynamic Content
9. Configure Interfaces
10. Create Zones
11. Configure Virtual Router
12. Add Static Route
13. Configure NAT
14. Create Security Policies
15. Configure DHCP (Optional)
16. Commit Configuration
17. Verify Internet Connectivity
18. Save Configuration Snapshot
19. Backup Running Configuration
20. Configure Panorama, Syslog, and SNMP (if applicable)

This checklist provides a solid foundation for deploying a new Palo Alto Networks firewall before adding advanced features such as High Availability (HA), GlobalProtect VPN, URL Filtering, SSL Decryption, User-ID, and advanced threat prevention.