PAN-OS

PAN-OS is software running on Palo Alto firewalls. providing Firewall capabilities, QoS, URL Filtering, packet inspection and threat prevention (WildFire).

• Threat prevention (Wildfire). Features: https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/wildfire-features-in-panos-90.html
• PAN-OS daemons: RASMGR, SSLMGR, SATD, IDE, Route and IKE

PAN-OS CLI

• configure
• commit
• show
• show system info
• show system state
• show system disk-space files
• less mp-log authd.log
• show routing route
• show running nat-policy (See also: https://en.wikiversity.org/wiki/Cisco_Networking/CCENT/Network_Services#NAT_Configuration)
• show running security-policy
• edit rulebase security
• edit rulebase nat

VPN

• show vpn flow
• show vpn gateway
• show vpn ike-sa
• show vpn ipsec-sa
• show vpn tunnel

PVST+ commands

Troubleshooting

• ping host <destination-ip-address>
• ping source <ip-address-on-dataplane> host <destination-ip-address>
• show netstat statistics yes

Panorama

• show log-collector preference-list
• show logging-status device <firewall-serial-number>

Logs

• show log config

Wildfire

• show wildfire wf-vm-pe-utilization
• show wildfire wf-vm-doc-utilization
• show wildfire wf-vm-elinkda-utilization
• show wildfire wf-vm-archive-utilization
• show wildfire global sample-device-lookup sha256 equal <SHA_256>.
• show wildfire local sample-processed {time [last-12-hrs | last-15-minutes | last-1-hr | last-24-hrs | last-30-days | last-7-days | last-calender-day | last-calender-month] \ count <number_of_samples>}.

Rules

• set rulebase security rules YOUR_RULES_NAMES from Untrust to Trust source any destination any application any service any action allow
• move rulebase security rules YOUR_RULE_NAME top
• move rulebase security rules YOUR_RULE_NAME before YOUR_OTHER_RULE_NAME
• delete rulebase security rules YOUR_RULE_NAME

NAT (Valid actions: top, bottom, before, after)

• set rulebase nat rules YOUR_RULE_NAME source-translation dynamic-ip-and-port interface-address interface ethernet1/2
• move rulebase nat rules YOUR_RULE_NAME top
• delete rulebase nat rules YOUR_RULE_NAME

PAN-OS Releases

• PAN-OS 9.0 (Release Notes: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-release-notes.html)
  • Easy transition your legacy rulebase to a best practice application-based rulebase
  • Strict Enforcement of Standard Ports
  • Real-Time Enforcement and Expanded Capacities for DAGs
  • Panorama can now manage up to 5,000 firewall
  • Multi-Category and Risk-Based URL Filtering
  • DNS Security Service
  • Policy Match and Connectivity Tests from the Web Interface
  • HTTP/2 Inspection
  • Consolidated Deployment for GlobalProtect Portals and Gateways
• PAN-OS 8.0 End-of-life on October 31, 2019

Activities

Basic

• Review additional PAN-OS examples: https://www.thegeekstuff.com/2019/06/paloalto-cli-security-nat-policy/
• Create a backup of your configuration: https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/9-0/pan-os-admin/firewall-administration/manage-configuration-backups.html
• Read PAN-OS 9.0 Administration guide:
  • https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/pan-os/9-0/pan-os-admin/pan-os-admin.pdf
  • https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin
• Read PAN-OS 9.0 New features guide: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features.html such as Rule Changes Archive
• Read PAN-OS 7.1 Release Notes: https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-release-notes/pan-os-7-1-release-information/features-introduced-in-pan-os-7-1
• Review PAN-OS CLI Quick Start: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-cli-quick-start/cli-cheat-sheets.html

Intermediate

• Create a IPSec VPN access in tunnel mode (transport mode not supported): https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK
• Configure MFA: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/authentication/configure-multi-factor-authentication.html
• Configure syslog monitoring https://www.manageengine.com/products/firewall/help/configure-paloalto-firewalls.html

See also

• DMZ, Port knocking, Bastion host, Firewall Software: iptables ufw firewalld nftables firewall-cmd ipfw (FreeBSD) PF (OpenBSD), netsh advfirewall, PAN-OS, WAF, pfsense, VyOS, Cisco ASA, DMZ, F5, URL Filtering, port forwarding, macOS application firewall, Windows firewall, Fortigate, ngrok, Network ACL
• Cisco IOS, PAN-OS, Junos OS, FortiOS

Draft - Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. https://en.wikiversity.org/wiki/Draft:Firewall/Palo_Alto_PA-Series/PAN-OS