- Objectives<\/a><\/li>
- EVE-NG Lab Setup<\/a>
- Configuring Management Interface<\/a>
- Changing The IP on the Management Interface<\/a><\/li><\/ul><\/li><\/ul><\/li>
- Configuring Zones<\/a>
- Common Zone Types<\/a><\/li>
- Creating Zones on the Palo Alto Firewall<\/a><\/li><\/ul><\/li>
- Configuring Interfaces<\/a>
- Trusted\/Inside Zone Interface eth1\/1<\/a><\/li>
- Untusted\/Outside Zone Interface eth1\/2<\/a><\/li><\/ul><\/li>
- Configuring a Security Policy<\/a>
- Default Security Policies<\/a><\/li>
- Inside-to-Outside Security Policy<\/a><\/li><\/ul><\/li>
- Configuring NAT<\/a>
- Creating a NAT Rule<\/a><\/li><\/ul><\/li>
- Testing the connectivity<\/a><\/li><\/ul>\n\t\t\t<\/div>\n\t\t<\/div><\/div>\n\n\n
<\/div>\n\n\n\nObjectives<\/mark><\/h2>\n\n\n\n
In this write-up, we will be covering the step-by-step approach to configuring a Palo Alto firewall from scratch. The below-mentioned list does not have to be in sequence; it is based on my personal preference.<\/p>\n\n\n\n
The initial configuration of a Palo Alto firewall requires but not limited to:<\/p>\n\n\n\n
- \n
- Assigning an IP address to the Management Interface<\/li>\n\n\n\n
- Creating Zones<\/li>\n\n\n\n
- Configuring Interfaces<\/li>\n\n\n\n
- Configuring a Security Profile<\/li>\n\n\n\n
- Configuring NAT<\/li>\n\n\n\n
- Testing Internet Connectivity<\/li>\n<\/ul>\n\n\n\n<\/div>\n\n\n\n
EVE-NG Lab Setup<\/mark><\/h2>\n\n\n\n
In this lab, we will create a simple topology focusing mainly on configuring the basic but crucial settings on the Palo Alto firewall as part of its initial configuration.<\/p>\n\n\n\n
<\/div>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/blog.ishsome.com\/wp-content\/uploads\/2024\/06\/image-5.png?resize=797%2C458&ssl=1\")
<\/figure>\n\n\n\n<\/div>\n\n\n\nWe have a Palo Alto VM running PAN-OS 10.1.12<\/mark><\/strong> in this lab setup. We have chosen two Linux machines; one for management, and the other for Internet access. All the IP addresses on the devices (nodes) are statically assigned. <\/p>\n\n\n\n
<\/div>\n\n\n\nConfiguring Management Interface<\/mark><\/h3>\n\n\n\n
When the firewall first boots up, the default IP address on the management interface is set to 192.168.1.1<\/mark><\/strong>. When a Palo Alto firewall is first configured, the following services are typically enabled on the management interface:<\/p>\n\n\n\n
- \n
- HTTPS (Web Management)<\/strong>: This allows access to the web-based management interface (GUI) over HTTPS. Administrators can use a web browser to configure and manage the firewall.<\/li>\n\n\n\n
- SSH<\/strong>: Secure Shell (SSH) is enabled for secure command-line interface (CLI) access. This allows administrators to manage the firewall through a terminal or SSH client.<\/li>\n\n\n\n
- Ping<\/strong>: ICMP Echo Requests (ping) are usually enabled to allow the firewall to be reachable via ICMP for basic connectivity testing.<\/li>\n<\/ol>\n\n\n\n
These services are essential for the initial configuration and ongoing management of the firewall. Additional services and configurations can be enabled or modified as needed through the management interface.<\/p>\n\n\n\n
Based on our lab topology, we will change the management IP address to 172.16.32.1\/24<\/mark><\/strong>. To do this, we need to access the CLI of the firewall and log in using the default credentials of admin: admin. Once you’re logged in, you will be prompted to change the default password. Here, make sure to include 1 Upper-case, 1 Number, and 1 character\/symbol when changing the default password.<\/p>\n\n\n\n
<\/div>\n\n\n\n\n
Wait for the firewall to fully boot up, otherwise the default credentials won\u2019t work. When you see the admin@PA-VM prompt, you should be able to login.<\/p>\n<\/blockquote>\n<\/div>\n\n\n\n
<\/div>\n\n\n\nChanging The IP on the Management Interface<\/mark><\/h4>\n\n\n\n
To change the IP address on the management interface, run the following commands in the firewall CLI.<\/p>\n\n\n\n
<\/div>\n\n\n\n - SSH<\/strong>: Secure Shell (SSH) is enabled for secure command-line interface (CLI) access. This allows administrators to manage the firewall through a terminal or SSH client.<\/li>\n\n\n\n
- HTTPS (Web Management)<\/strong>: This allows access to the web-based management interface (GUI) over HTTPS. Administrators can use a web browser to configure and manage the firewall.<\/li>\n\n\n\n
- Testing the connectivity<\/a><\/li><\/ul>\n\t\t\t<\/div>\n\t\t<\/div><\/div>\n\n\n
- Inside-to-Outside Security Policy<\/a><\/li><\/ul><\/li>
- Untusted\/Outside Zone Interface eth1\/2<\/a><\/li><\/ul><\/li>
- Creating Zones on the Palo Alto Firewall<\/a><\/li><\/ul><\/li>
- Configuring Zones<\/a>
- Changing The IP on the Management Interface<\/a><\/li><\/ul><\/li><\/ul><\/li>
- EVE-NG Lab Setup<\/a>