Editing PAN-OS
Jump to navigation
Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
− | + | PAN-OS is software running on [[Firewall/Palo Alto PA-Series|Palo Alto firewalls]].<ref>https://docs.paloaltonetworks.com/pan-os</ref> providing [[Firewall]] capabilities, [[QoS]], [[URL Filtering]], [[packet inspection]] and [[threat prevention]] (WildFire). | |
− | + | * Threat prevention ([[WildFire]]). Features: https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/wildfire-features-in-panos-90.html | |
− | + | * PAN-OS daemons: [[RASMGR]], [[SSLMGR]], [[SATD]], [[IDE]], [[Route]] and [[IKE]] | |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | * | ||
* PAN-OS authentication methods: [[Kerberos]], [[RADIUS]], [[LDAP]], [[SAML]] 2.0, client certificates, biometric sign-in, and a local user database | * PAN-OS authentication methods: [[Kerberos]], [[RADIUS]], [[LDAP]], [[SAML]] 2.0, client certificates, biometric sign-in, and a local user database | ||
− | |||
− | |||
== PAN-OS CLI == | == PAN-OS CLI == | ||
* <code>configure</code> | * <code>configure</code> | ||
* <code>commit</code> | * <code>commit</code> | ||
− | |||
* <code>show</code> | * <code>show</code> | ||
− | * <code> | + | * <code>show system info</code> |
− | + | * <code>show system state</code> | |
− | |||
− | * <code> | ||
− | |||
* <code>show system disk-space files</code> | * <code>show system disk-space files</code> | ||
* <code>less mp-log authd.log</code> | * <code>less mp-log authd.log</code> | ||
* <code>[[show routing route]]</code> | * <code>[[show routing route]]</code> | ||
− | * <code> | + | * <code>show running [[nat]]-policy</code> (See also: https://en.wikiversity.org/wiki/Cisco_Networking/CCENT/Network_Services#NAT_Configuration) |
− | * <code> | + | * <code>show running security-policy</code> |
− | |||
* <code>show jobs id x</code> | * <code>show jobs id x</code> | ||
* <code>edit rulebase security</code> | * <code>edit rulebase security</code> | ||
* <code>edit rulebase nat</code> | * <code>edit rulebase nat</code> | ||
− | + | [[VPN]] | |
− | |||
{{show vpn TOC}} | {{show vpn TOC}} | ||
[[PVST+]] commands | [[PVST+]] commands | ||
− | + | Troubleshooting | |
*<code>[[ping]] host <destination-ip-address></code> | *<code>[[ping]] host <destination-ip-address></code> | ||
*<code>ping source <ip-address-on-dataplane> host <destination-ip-address></code> | *<code>ping source <ip-address-on-dataplane> host <destination-ip-address></code> | ||
*<code>show [[netstat]] statistics yes</code> | *<code>show [[netstat]] statistics yes</code> | ||
− | |||
− | + | Panorama | |
*<code>show log-collector preference-list</code> | *<code>show log-collector preference-list</code> | ||
*<code>show logging-status device <firewall-serial-number></code> | *<code>show logging-status device <firewall-serial-number></code> | ||
− | + | Logs | |
* <code>[[show log config]]</code> | * <code>[[show log config]]</code> | ||
− | |||
− | |||
* <code>[[show log system]]</code> | * <code>[[show log system]]</code> | ||
− | + | Wildfire | |
− | * <code> | + | * <code>show wildfire wf-vm-pe-utilization</code> |
* <code>show wildfire wf-vm-doc-utilization</code> | * <code>show wildfire wf-vm-doc-utilization</code> | ||
* <code>show wildfire wf-vm-elinkda-utilization</code> | * <code>show wildfire wf-vm-elinkda-utilization</code> | ||
Line 74: | Line 56: | ||
* <code>move rulebase nat rules YOUR_RULE_NAME top</code> | * <code>move rulebase nat rules YOUR_RULE_NAME top</code> | ||
* <code>delete rulebase nat rules YOUR_RULE_NAME</code> | * <code>delete rulebase nat rules YOUR_RULE_NAME</code> | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
== Activities == | == Activities == | ||
=== Basic === | === Basic === | ||
* Review additional PAN-OS examples: https://www.thegeekstuff.com/2019/06/paloalto-cli-security-nat-policy/ | * Review additional PAN-OS examples: https://www.thegeekstuff.com/2019/06/paloalto-cli-security-nat-policy/ | ||
− | * Create a | + | * Create a backup of your configuration: https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/9-0/pan-os-admin/firewall-administration/manage-configuration-backups.html |
* Read PAN-OS 9.0 Administration guide: | * Read PAN-OS 9.0 Administration guide: | ||
** https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/pan-os/9-0/pan-os-admin/pan-os-admin.pdf | ** https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/pan-os/9-0/pan-os-admin/pan-os-admin.pdf | ||
Line 96: | Line 68: | ||
* Review PAN-OS CLI Quick Start: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-cli-quick-start/cli-cheat-sheets.html | * Review PAN-OS CLI Quick Start: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-cli-quick-start/cli-cheat-sheets.html | ||
* Read Palo Alto basics of [[Palo Alto traffic monitoring filtering]]: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSlCAK | * Read Palo Alto basics of [[Palo Alto traffic monitoring filtering]]: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSlCAK | ||
− | |||
− | |||
− | |||
=== Intermediate === | === Intermediate === | ||
* Create a [[IPSec]] [[VPN]] access in tunnel mode (transport mode not supported): https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK | * Create a [[IPSec]] [[VPN]] access in tunnel mode (transport mode not supported): https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK | ||
* Configure [[MFA]]: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/authentication/configure-multi-factor-authentication.html | * Configure [[MFA]]: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/authentication/configure-multi-factor-authentication.html | ||
− | * Configure [[ | + | * Configure [[syslog]] monitoring https://www.manageengine.com/products/firewall/help/configure-paloalto-firewalls.html |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
== See also == | == See also == | ||
Line 134: | Line 85: | ||
[[Category:IT]] | [[Category:IT]] | ||
− | |||
Draft - Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. https://en.wikiversity.org/wiki/Draft:Firewall/Palo_Alto_PA-Series/PAN-OS | Draft - Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. https://en.wikiversity.org/wiki/Draft:Firewall/Palo_Alto_PA-Series/PAN-OS |
Advertising: