├── chapter 14 - cfg-init.txt example ├── chapter 14 - cfg-init.txt DHCP example ├── LICENSE ├── chapter 13 - flow basic commands ├── Policy filter cheat sheet ├── override example ├── README.md ├── chapter 13 - CLI cheat sheet ├── chapter 13 - flow basic transcript ├── Chapter 7: Panorama example configuration └── SharedGatewayExample /chapter 14 - cfg-init.txt example: -------------------------------------------------------------------------------- 1 | type=static 2 | ip-address=10.0.0.5 3 | default-gateway=10.0.0.1 4 | netmask=255.255.255.0 5 | ipv6-address= 6 | ipv6-default-gateway= 7 | hostname=FirewallPG1 8 | vm-auth-key= 9 | panorama-server=10.0.0.20 10 | panorama-server-2= 11 | tplname=Template-PG 12 | dgname=Devgrp-PG 13 | dns-primary=1.1.1.1 14 | dns-secondary=1.0.0.1 15 | op-command-modes=jumbo-frame 16 | op-cmd-dpdk-pkt-io= 17 | plugin-op-commands= 18 | dhcp-send-hostname=no 19 | dhcp-send-client-id=no 20 | dhcp-accept-server-hostname=no 21 | dhcp-accept-server-domain=no 22 | vm-series-auto-registration-pin-id= 23 | vm-series-auto-registration-pin-value= 24 | -------------------------------------------------------------------------------- /chapter 14 - cfg-init.txt DHCP example: -------------------------------------------------------------------------------- 1 | type=dhcp-client 2 | ip-address= 3 | default-gateway= 4 | netmask= 5 | ipv6-address= 6 | ipv6-default-gateway= 7 | hostname=firewallPG 8 | vm-auth-key= 9 | panorama-server=10.0.0.20 10 | panorama-server-2= 11 | tplname=Ftemplate-PG 12 | dgname=devgrp-PG 13 | dns-primary=1.1.1.1 14 | dns-secondary=1.0.0.1 15 | op-command-modes=jumbo-frame 16 | op-cmd-dpdk-pkt-io= 17 | plugin-op-commands= 18 | dhcp-send-hostname=yes 19 | dhcp-send-client-id=yes 20 | dhcp-accept-server-hostname=yes 21 | dhcp-accept-server-domain=yes 22 | vm-series-auto-registration-pin-id= 23 | vm-series-auto-registration-pin-value= 24 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2020 Packt 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /chapter 13 - flow basic commands: -------------------------------------------------------------------------------- 1 | ###preparation### 2 | debug dataplane packet-diag clear all 3 | debug dataplane packet-diag clear log log 4 | debug dataplane packet-diag clear filter-marked-session all 5 | debug dataplane packet-diag set filter match source 10.0.0.10 destination 198.51.100.2 6 | debug dataplane packet-diag set filter match source 10.0.0.10 destination 198.51.100.1 7 | debug dataplane packet-diag set filter match source 198.51.100.1 destination 198.51.100.2 8 | debug dataplane packet-diag set filter match destination 198.51.100.2 9 | debug dataplane packet-diag set filter on 10 | ###optionally enable packet capture### 11 | ###debug dataplane packet-diag set capture stage receive file rx.pcap 12 | ###debug dataplane packet-diag set capture stage transmit file tx.pcap 13 | ###debug dataplane packet-diag set capture stage firewall file fw.pcap 14 | ###debug dataplane packet-diag set capture stage drop file drp.pcap 15 | debug dataplane packet-diag show setting 16 | 17 | ###prelaunch### 18 | show session all filter source 10.0.0.10 19 | set session offload no 20 | debug dataplane packet-diag set log feature flow basic 21 | debug dataplane packet-diag set log on 22 | #debug dataplane packet-diag set capture on 23 | 24 | ###launch### 25 | show counter global filter delta yes packet-filter yes 26 | show clock 27 | show counter global filter delta yes packet-filter yes 28 | show session all filter source 10.0.0.10 29 | show counter global filter delta yes packet-filter yes 30 | show session all filter source 10.0.0.10 31 | show session all filter source 10.0.0.10 32 | show session id 270 33 | show session all filter source 10.0.0.10 34 | show session all filter source 10.0.0.10 35 | show counter global filter delta yes packet-filter yes 36 | show clock 37 | 38 | ###end### 39 | debug dataplane packet-diag set log off 40 | debug dataplane packet-diag set capture off 41 | set session offload yes 42 | 43 | ###reading and collecting the output### 44 | debug dataplane packet-diag aggregate-logs 45 | less mp-log pan_packet_diag.log 46 | scp export log-file management-plane to user@host:/path/ 47 | view-pcap filter-pcap rx.pcap 48 | scp export filter-pcap from *.pcap to user@host:/path 49 | 50 | -------------------------------------------------------------------------------- /Policy filter cheat sheet: -------------------------------------------------------------------------------- 1 | ## searched terms are case sensitive! (Untrust or untrust) 2 | ## operands include 'eq', 'neq' , 'contains' 3 | 4 | Tags: (tag/member eq 'tagname') 5 | Name: (name contains 'unlocate-block') 6 | Type: (rule-type eq 'intrazone|interzone') 7 | Source Zone: (from/member eq 'zonename') 8 | Source Address: (source/member eq 'any|ip|object') 9 | Source User: (source-user/member eq 'any|username|groupname') 10 | Hip profile: (hip-profiles/member eq 'any|profilename') 11 | Destination Zone: (to/member eq 'zonename') 12 | Destination Address: (destination/member eq 'any|ip|object') 13 | Destination User: (destination-user/member eq 'any|username|groupname') 14 | Application: (application/member eq 'any|applicationname|applicationgroup|applicationfilter') 15 | Service: (service/member eq 'any|servicename|application-default') 16 | URL Category: (category/member eq 'any|categoryname') 17 | ## This is a destination category, not a URL filtering security profile 18 | 19 | Action: (action eq 'allow|drop|deny|reset-client|reset-server|reset-both') 20 | Action send ICMP unreachable: (icmp-unreachable eq 'yes') 21 | Security Profiles: 22 | (profile-setting/profiles/virus/member eq 'profilename') 23 | (profile-setting/profiles/spyware/member eq 'profilename') 24 | (profile-setting/profiles/vulnerability/member eq 'profilename') 25 | (profile-setting/profiles/url-filtering/member eq 'profilename') 26 | (profile-setting/profiles/file-blocking/member eq 'profilename') 27 | (profile-setting/profiles/wildfire-analysis/member eq 'profilegroupname') 28 | (profile-setting/group/member eq 'profilename') 29 | Disable server response inspection: (option/disable-server-response-inspection eq 'yes') 30 | Log at session start: (log-start eq 'yes|no') 31 | Log at session end: (log-end eq 'yes|no') 32 | Schedule: (schedule eq 'schedulename') 33 | Log Forwarding: (log-setting eq "forwardingprofilename') 34 | Qos Marking: (qos/marking/ip-dscp eq 'codepoint') 35 | (qos/marking/ip-precedence eq 'codepoint') 36 | (qos/marking/follow-c2s-flow eq '') 37 | Description: (description contains '') 38 | Disabled policy: (disabled eq yes|no) 39 | ## policies will only respond to 'no' if they have been disabled before 40 | 41 | -------------------------------------------------------------------------------- /override example: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | Your Device has been Quarantined 11 | 12 | 127 | 134 | 135 | 136 | 137 |
138 |

Your Device has been Quarantined

139 |

The web page you are trying to visit has been blocked because your device has been placed in quarantine. Please contact your system administrator to seek remediation immediately.

140 |
141 |

User:

142 | 143 |
144 | 145 |
146 | 147 |
148 |
149 |
150 | 151 | 152 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | # Mastering Palo Alto Networks 5 | 6 | Mastering Palo Alto Networks 7 | 8 | This is the code repository for [Mastering Palo Alto Networks](https://www.packtpub.com/cloud-networking/mastering-palo-alto-networks?utm_source=github&utm_medium=repository&utm_campaign=9781789956375), published by Packt. 9 | 10 | **Deploy and manage industry-leading PAN-OS 10.x solutions to secure your users and infrastructure** 11 | 12 | ## What is this book about? 13 | To safeguard against security threats, it is crucial to ensure that your organization is effectively secured across networks, mobile devices, and the cloud. Palo Alto Networks’ integrated platform makes it easy to manage network and cloud security along with endpoint protection and a wide range of security services. With this book, you'll understand Palo Alto Networks and learn how to implement essential techniques, right from deploying firewalls through to advanced troubleshooting.ription 14 | 15 | This book covers the following exciting features: 16 | * Perform administrative tasks using the web interface and command-line interface (CLI) 17 | * Explore the core technologies that will help you boost your network security 18 | * Discover best practices and considerations for configuring security policies 19 | * Run and interpret troubleshooting and debugging commands 20 | * Manage firewalls through Panorama to reduce administrative workloads 21 | 22 | If you feel this book is for you, get your [copy](https://www.amazon.com/dp/1789956374) today! 23 | 24 | https://www.packtpub.com/ 25 | 26 | ## Instructions and Navigations 27 | All of the code is organized into folders. For example, Chapter02. 28 | 29 | The code will look like the following: 30 | ``` 31 | if (test expression) 32 | { 33 | Statement upon condition is true 34 | } 35 | ``` 36 | 37 | **Following is what you need for this book:** 38 | This book is for network engineers, network security analysts, and security professionals who want to understand and deploy Palo Alto Networks in their infrastructure. Anyone looking for in-depth knowledge of Palo Alto Network technologies, including those who currently use Palo Alto Network products, will find this book useful. Intermediate-level network administration knowledge is necessary to get started with this cybersecurity book. 39 | 40 | With the following software and hardware list you can run all code files present in the book (Chapter 1-13). 41 | 42 | ### Software and Hardware List 43 | 44 | | Chapter | Software required | OS required | 45 | | -------- | ------------------------------------| ---------------------------------------------------------| 46 | | 1-13 | PAN-OS, all chassis and VM versions | Any OS capable of supporting a web browser and SSH client| 47 | 48 | 49 | 50 | We also provide a PDF file that has color images of the screenshots/diagrams used in this book. [Click here to download it](http://www.packtpub.com/sites/default/files/downloads/9781789956375_ColorImages.pdf). 51 | 52 | ## Code in Action 53 | 54 | Click on the following link to see the Code in Action: 55 | 56 | [YouTube](https://www.youtube.com/playlist?list=PLeLcvrwLe185oVaR7utR4mKlqow4VImk_) 57 | 58 | ### Related products 59 | * Cybersecurity Attacks – Red Team Strategies [[Packt]](https://www.packtpub.com/security/cybersecurity-attacks-red-team-strategies?utm_source=github&utm_medium=repository&utm_campaign=9781838828868) [[Amazon]](https://www.amazon.com/dp/1838828869) 60 | 61 | * Mastering Windows Security and Hardening [[Packt]](https://www.packtpub.com/security/mastering-windows-security-and-hardening?utm_source=github&utm_medium=repository&utm_campaign=9781839216411) [[Amazon]](https://www.amazon.com/dp/1839216417) 62 | 63 | ## Get to Know the Author 64 | 65 | **Tom Piens**, PCNSE, CISSP, and founder of PANgurus, has nearly 10 years of experience working with Palo Alto Networks customers. Tom has been at the forefront of engaging with customers, responding to questions, and analyzing unique needs to apply the best possible solutions or workarounds. He has authored a great many articles on the Palo Alto Networks knowledge base and discussion forum solutions, including the popular Getting Started series. Also known as “reaper” on the PANgurus and LIVEcommunity forums, and @PANWreaper on Twitter, Tom has been recognized by Palo Alto Networks user groups and community members, and by countless thankful customers. 66 | 67 | 68 | ### Suggestions and Feedback 69 | [Click here](https://docs.google.com/forms/d/e/1FAIpQLSdy7dATC6QmEL81FIUuymZ0Wy9vH1jHkvpY57OiMeKGqib_Ow/viewform) if you have any feedback or suggestions. 70 | ### Download a free PDF 71 | 72 | If you have already purchased a print or Kindle version of this book, you can get a DRM-free PDF version at no cost.
Simply click on the link to claim your free PDF. 73 |

https://packt.link/free-ebook/9781789956375

-------------------------------------------------------------------------------- /chapter 13 - CLI cheat sheet: -------------------------------------------------------------------------------- 1 | Command Function 2 | find command keyword Lets you find any command as long as you know what you're looking for. 3 | | match Filters the output of a command and only return the line that has a positive match. 4 | | except Filters the output of a command and return everything except the lines that match the value. 5 | tcpdump snaplen 0 filter "not port 22" Captures all sessions on the management interface except sessions on port 22. 6 | view-pcap debug-pcap|filter-pcap|mgmt-pcap no-dns-lookup Shows packet captures taken on daemons, via packet-diag or tcpdump. 7 | show admins Shows currently logged-in admins. 8 | delete admin-sessions username Terminates an admin's session. 9 | set system setting target-vsys Change operational commends to a vsys perspective. 10 | show authentication allowlist Shows the allow list for all authentication profiles. 11 | show system environmentals Shows system core temperatures and power levels. 12 | scp|tftp export to user@destination:/path/ Many things can be exported from the system, including log files, packet captures, or core files. 13 | 14 | Basic system information 15 | show system info Returns basic device information like serial, IP, installed content and software versions. 16 | show system software status Shows if all processes are running properly. 17 | show system logdb-quota Returns the log db usage. 18 | show system disk-space Returns disk volume information. 19 | show jobs all/id Returns status of all commit, download, install and qfdn jobs, and additional details on specific IDs. 20 | show system files Shows if any core dump files have been created due to a process crash. 21 | request license fetch/info Retrieves and shows currently active licenses. 22 | show netstat all yes Shows all listening and established connections on the management plane, per process. 23 | show chassis-ready Shows if the dataplane is ready to process sessions. 24 | show panorama-status Verify connectivity with panorama. 25 | 26 | High Availability 27 | show high-availability state Shows a quick rundown of the local peer's HA condition. 28 | show high-availability all Summary of all HA runtime. 29 | show high-availability state-synchronization Displays statistics about sent and received sync messages. 30 | request high-availability sessions-reestablish force Reestablishes HA1 link if link was lost, use 'force' if HA1 backup is not configured. 31 | show high-availability session-reestablish-status Shows when HA1 and HA1-backup links were last reestablished. 32 | request high-availability sync-to-remote running-config manually Syncs running configuration to peer, in case automatic sync failed or if status is out-of-sync. 33 | request high-availability state functional|suspend Suspend or activate local device. 34 | request high-availability state peer functional|suspend Suspend or activate peer device. 35 | show high-availability transitions Indicates how many times a device has transitioned between HA states. 36 | show high-availability flap statistics Details about preemptions 'flaps' (preemption activates device, error encountered again, device non-funct, recovers, preempt activates, error encountered again, etc.). 37 | show high-availability control-link statistics Detailed information about HA1 messages. 38 | 39 | performance information 40 | show system resources Shows management plane resource usage like 'top' in linux. 41 | show running resource-monitor Shows dataplane CPU core utilization and buffer usage. 42 | debug dataplane pool statistics Shows software buffer pool usage. 43 | show session info Shows number of active sessions, packets per second, thoughput and other session related paramerters. 44 | debug log-receiver statistics Information on log volume per second and any errors while writing or forwarding log. 45 | show system statistics application|session Shows live statistics about top applications, or system throughput. 46 | show report jobs Indicate if reports are currently being generated (this could have an impact on management plane CPU usage). 47 | 48 | dns operations 49 | show system setting ssl-decrypt dns-cache  Shows ssl decryption dns cache. 50 | show dns-proxy cache all  Shows the dns proxy cache. 51 | show system setting ssl-decrypt memory  Shows ssl decryption memory usage. 52 | show dns-proxy fqdn all Show all FQDN objects with their resolved IP addresses. 53 | request system fqdn refresh Refresh all FQDN objects. 54 | debug dataplane internal vif link  Returns statistics on the internal hardwre interfaces. 55 | 56 | packet flow 57 | show counter global filter delta yes Shows global counters. 58 | show session all filter Shows active, discard and predict sessions matching the filer (or 'all' sessions). 59 | set session offload yes|no Enables and disables session offloading to hardware. 60 | set session tcp-reject-non-syn yes|no Disable dropping TCP ACK packets coming in without a proper handshake. 61 | # set deviceconfig setting tcp asymmetric-path bypass|drop Disable dropping packets that arrive out of window or out of sync. 62 | 63 | Layer 2 and 3 64 | show routing route Output the routing table (Routing Informtion Base, or rib). 65 | show routing fib Shows the forwarding table (Forwarding Information Base). 66 | show arp all Shows the content of the ARP table (layer 3). 67 | show mac all Shows the content of the MAC table (layer 2). 68 | show routing protocol ospf|bgp|rip summary Returns a summary of the ospf, bgp or rip status. 69 | show routing resource Verify the number of routes is not reaching the system limits. 70 | debug routing pcap ospf|bgp|rip on|off eEnables/disables packetcaptures on the routing engine for the routing protocol. Use for troubleshooting only. 71 | 72 | policies 73 | show running nat-policy Show all active NAT rules. 74 | show running nat-rule-ippool rule Show memory usage, over subscription ratio and allocations per rule. 75 | show running global-ippool Show runtime statistics for global dynamic source nat. 76 | show running ippool Show overall source nat statistics. 77 | show session all filter qos-class [1-8] Displays all sessions that match a specific QoS class. 78 | show qos interface counter Shows general counter on QoS configured on an interface. 79 | show qos interface throughput Returns actual throughput for a Qid on an interface. 80 | show zone-protection zone Show zone protection statistics for the zone. 81 | show dos-protection rule statistics Show statistics for a dos-protection rule. 82 | show dos-protection zone blocked source Show swhich IP addresses are currently being blocked due to DoS protection. 83 | 84 | URL filtering 85 | test url-info-cloud Show the category for a URL via cloud lookup. 86 | test url-info-host Show the category for a URL in the Management plane cache. 87 | show running url Show the category for a URL in the dataplane cache. 88 | request url-iltering update url Refreshes the management plane cache entry for a url with a cloud lookup. 89 | show running url-cache all Outputs the URL cache to mp-log dp_url_DB.log. 90 | show running url-cache statistics Shows memory usage of the URL cache. 91 | show url-cloud status Returns connectivity information for URL lookup cloud connection. 92 | clear url-cache all|url Clears a single url from cache, or the entire cache from dataplane. 93 | delete url-database all|url Clears a single url from cache, or the entire cache from management plane. 94 | 95 | Panorama 96 | show logging-status device Returns log forwarding information for a device logging to panorama. 97 | debug log-collector log-collection-stats show incoming-logs  Shows incoming log statistics including current log rate. 98 | show system raid detail  Shows information of RAID array on M- appliance. 99 | show system disk details  Shows information of disk status on VM- appliance. 100 | replace old new Start log forwrding from device from the last log|last acked log. 102 | request log-fwd-ctrl start|stop latest device Start or stop log forwarding from a device to panorama wit buffering. 103 | request log-fwd-ctrl action live device Start log forwarding without buffering (this could cause a large flood of inbound logs). 104 | 105 | IPSec 106 | show running tunnel flow info  Shows basic statistics about all vpn tunnels. 107 | test vpn ike-sa gateway Initiates an IKE negotiation with the designated gateway. 108 | test vpn ipsec-sa tunnel Initiates an ipsec negotiation for the designated tunnel. 109 | clear vpn ike-sa gateway Clears the IKE SA for a given gateway. 110 | clear vpn ipsec-sa tunnel Clears the IPSec SA for a given tunnel. 111 | show vpn ike-sa gateway Shows the IKE SA for a given gateway. 112 | show vpn ipsec-sa tunnel Shows the IPSec SA for a given tunnel. 113 | show global-protect-gateway current-satellite Show currently connected satellites to GlobalProtect. 114 | show global-protect-gateway current-user Show currently connected users to GlobalProtect. 115 | 116 | User-ID 117 | show user ip-user-mapping all|ip Show all mapped users or the mapped user(s) for a specific IP on the dataplane. 118 | show user ip-user-mapping-mp all|ip Show all mapped users or the mapped user(s) for a specific IP on the management plane. 119 | debug user-id refresh group-mapping all Refresh group-mapping memberships. 120 | show user group list Show all groups used in group-mapping. 121 | show user group name Shows all members of a group. 122 | show user group-mapping state all Show the state of all group mapping profiles. 123 | show user group-mapping statistics Show last/next refresh of group mapping. 124 | show user user-id-agent statistics | state all Show user-ID agent state and statistics. 125 | show user ts-agent statistics |state all Show terminal server agent state and statistics. 126 | show user server-monitor statistics|state all  Shows the state of the agentless User-ID agent. 127 | show user ip-port-user-mapping all Show user to port mapping for terminal server agents or a specific server IP. 128 | 129 | WildFire 130 | show wildfire status Show connection status to wildfire cloud. 131 | show sildfire statistics Show file transfer statistics. 132 | test wildfire registration  Test connectivity to wildfire cloud. 133 | 134 | services 135 | show dhcp server lease all Show all dhcp leases. 136 | clear dhcp lease interface ip|mac|expiredonly Clears a lease for an IP or MAC address, or all the expired ones. 137 | debug dhcpd pcap on|off Enables packetcapture of dhcp transactions on the daemon. 138 | show dhcp client state Show dhcp information for an interface that is DHCP client. 139 | request dhcp client release|renew Release or renew dhcp client lease for a dhcp client interface. 140 | 141 | super command 142 | show system state This command returns the stte of the entire device. 143 | show system state filter env.* Show system core temperatures and power levels. 144 | show system state | match fan Search the system state for any line containing 'fan' to find fan speeds. 145 | show system state | match cfg.general.max Returns the maximum number of configurable objects the system supports. 146 | show system state filter-pretty sys.s1.* Show information about all the interfaces in slot 1. 147 | 148 | -------------------------------------------------------------------------------- /chapter 13 - flow basic transcript: -------------------------------------------------------------------------------- 1 | reaper@PA-VM> debug dataplane packet-diag clear all 2 | 3 | Packet diagnosis setting set to default. 4 | reaper@PA-VM> debug dataplane packet-diag clear filter-marked-session all 5 | 6 | Unmark All sessions in packet debug 7 | reaper@PA-VM> debug dataplane packet-diag set filter match source 10.0.0.10 destination 198.51.100.2 8 | 9 | reaper@PA-VM> debug dataplane packet-diag set filter match source 10.0.0.10 destination 198.51.100.1 10 | 11 | reaper@PA-VM> debug dataplane packet-diag set filter match source 198.51.100.1 destination 198.51.100.2 12 | 13 | reaper@PA-VM> debug dataplane packet-diag set filter match destination 198.51.100.2 14 | 15 | reaper@PA-VM> debug dataplane packet-diag set filter on 16 | 17 | debug packet filter: on 18 | reaper@PA-VM> show session all filter source 10.0.0.10 19 | 20 | No Active Sessions 21 | reaper@PA-VM> set session offload no 22 | 23 | reaper@PA-VM> debug dataplane packet-diag set log feature flow basic 24 | 25 | reaper@PA-VM> debug dataplane packet-diag set log on 26 | 27 | Packet log is enabled 28 | reaper@PA-VM> show counter global filter delta yes packet-filter yes 29 | 30 | Global counters: 31 | Elapsed time since last sampling: 159.191 seconds 32 | 33 | name value rate severity category aspect description 34 | -------------------------------------------------------------------------------- 35 | pkt_recv 2 0 info packet pktproc Packets received 36 | pkt_sent 14 0 info packet pktproc Packets transmitted 37 | pkt_stp_rcv 2 0 info packet pktproc STP BPDU packets received 38 | flow_arp_pkt_rcv 2 0 info flow arp ARP packets received 39 | flow_arp_rcv_gratuitous 2 0 info flow arp Gratuitous ARP packets received 40 | flow_ip_cksm_sw_validation 9 0 info flow pktproc Packets for which IP checksum validation was done in software 41 | log_pkt_diag_us 82 0 info log system Time (us) spent on writing packet-diag logs 42 | -------------------------------------------------------------------------------- 43 | Total counters shown: 7 44 | -------------------------------------------------------------------------------- 45 | 46 | reaper@PA-VM> show counter global filter delta yes packet-filter yes 47 | 48 | Global counters: 49 | Elapsed time since last sampling: 5.588 seconds 50 | 51 | -------------------------------------------------------------------------------- 52 | Total counters shown: 0 53 | -------------------------------------------------------------------------------- 54 | 55 | reaper@PA-VM> show se 56 | > service-chain Show service chain information 57 | > session Show session information 58 | 59 | reaper@PA-VM> show session all filter source 10.0.0.10 60 | 61 | No Active Sessions 62 | reaper@PA-VM> show counter global filter delta yes packet-filter yes 63 | 64 | Global counters: 65 | Elapsed time since last sampling: 24.931 seconds 66 | 67 | -------------------------------------------------------------------------------- 68 | Total counters shown: 0 69 | -------------------------------------------------------------------------------- 70 | 71 | reaper@PA-VM> show session all filter source 10.0.0.10 72 | 73 | No Active Sessions 74 | reaper@PA-VM> show counter global filter delta yes packet-filter yes 75 | 76 | Global counters: 77 | Elapsed time since last sampling: 13.132 seconds 78 | 79 | name value rate severity category aspect description 80 | -------------------------------------------------------------------------------- 81 | session_allocated 4 0 info session resource Sessions allocated 82 | session_freed 4 0 info session resource Sessions freed 83 | flow_policy_nat_land 4 0 drop flow session Session setup: source NAT IP allocation result in LAND attack 84 | nat_dynamic_port_xlat 4 0 info nat resource The total number of dynamic_ip_port NAT translate called 85 | nat_dynamic_port_release 8 0 info nat resource The total number of dynamic_ip_port NAT release called 86 | log_pkt_diag_us 262 19 info log system Time (us) spent on writing packet-diag logs 87 | session_freed 1 0 info session resource Sessions freed 88 | flow_policy_nat_land 1 0 drop flow session Session setup: source NAT IP allocation result in LAND attack 89 | ctd_fwd_err_tcp_state 1 0 info ctd pktproc Forward to varrcvr error: TCP in establishment when session went away 90 | -------------------------------------------------------------------------------- 91 | Total counters shown: 9 92 | -------------------------------------------------------------------------------- 93 | 94 | reaper@PA-VM> show session all filter source 10.0.0.10 95 | 96 | No Active Sessions 97 | reaper@PA-VM> show session all filter source 10.0.0.10 98 | 99 | -------------------------------------------------------------------------------- 100 | ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port]) 101 | Vsys Dst[Dport]/Zone (translated IP[Port]) 102 | -------------------------------------------------------------------------------- 103 | 270 ssh ACTIVE FLOW NS 10.0.0.10[49402]/trust/6 (198.51.100.2[12607]) 104 | vsys1 198.51.100.1[22]/untrust (198.51.100.1[22]) 105 | reaper@PA-VM> show se 106 | > service-chain Show service chain information 107 | > session Show session information 108 | 109 | reaper@PA-VM> show session id 270 110 | 111 | Session 270 112 | 113 | c2s flow: 114 | source: 10.0.0.10 [trust] 115 | dst: 198.51.100.1 116 | proto: 6 117 | sport: 49402 dport: 22 118 | state: ACTIVE type: FLOW 119 | src user: unknown 120 | dst user: unknown 121 | 122 | s2c flow: 123 | source: 198.51.100.1 [untrust] 124 | dst: 198.51.100.2 125 | proto: 6 126 | sport: 22 dport: 12607 127 | state: ACTIVE type: FLOW 128 | src user: unknown 129 | dst user: unknown 130 | 131 | start time : Thu Jun 4 00:46:11 2020 132 | timeout : 3600 sec 133 | time to live : 3589 sec 134 | total byte count(c2s) : 3961 135 | total byte count(s2c) : 6143 136 | layer7 packet count(c2s) : 22 137 | layer7 packet count(s2c) : 27 138 | vsys : vsys1 139 | application : ssh 140 | rule : outbound 141 | service timeout override(index) : False 142 | session to be logged at end : True 143 | session in session ager : True 144 | session updated by HA peer : False 145 | address/port translation : source 146 | nat-rule : outbound hide(vsys1) 147 | layer7 processing : completed 148 | URL filtering enabled : True 149 | URL category : any 150 | session via syn-cookies : False 151 | session terminated on host : False 152 | session traverses tunnel : False 153 | session terminate tunnel : False 154 | captive portal session : False 155 | ingress interface : ethernet1/2 156 | egress interface : ethernet1/1 157 | session QoS rule : N/A (class 4) 158 | tracker stage l7proc : ctd decoder done 159 | end-reason : unknown 160 | reaper@PA-VM> 161 | reaper@PA-VM> show counter global filter delta yes packet-filter yes 162 | 163 | Global counters: 164 | Elapsed time since last sampling: 55.235 seconds 165 | 166 | name value rate severity category aspect description 167 | -------------------------------------------------------------------------------- 168 | pkt_recv 5 0 info packet pktproc Packets received 169 | pkt_sent 20 0 info packet pktproc Packets transmitted 170 | session_allocated 1 0 info session resource Sessions allocated 171 | flow_ip_cksm_sw_validation 27 0 info flow pktproc Packets for which IP checksum validation was done in software 172 | nat_dynamic_port_xlat 1 0 info nat resource The total number of dynamic_ip_port NAT translate called 173 | nat_dynamic_port_release 2 0 info nat resource The total number of dynamic_ip_port NAT release called 174 | dfa_sw 4 0 info dfa pktproc The total number of dfa match using software 175 | ctd_sml_exit_detector_i 1 0 info ctd pktproc The number of sessions with sml exit in detector i 176 | ctd_run_detector_i 1 0 info ctd pktproc run detector_i 177 | ctd_sml_vm_run_impl_opcodeexit 1 0 info ctd pktproc SML VM opcode exit 178 | ctd_pscan_sw 4 0 info ctd pktproc The total usage of software for pscan 179 | ctd_pkt_slowpath 4 0 info ctd pktproc Packets processed by slowpath 180 | log_pkt_diag_us 303 5 info log system Time (us) spent on writing packet-diag logs 181 | -------------------------------------------------------------------------------- 182 | Total counters shown: 13 183 | -------------------------------------------------------------------------------- 184 | 185 | reaper@PA-VM> show session all filter source 10.0.0.10 186 | 187 | -------------------------------------------------------------------------------- 188 | ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port]) 189 | Vsys Dst[Dport]/Zone (translated IP[Port]) 190 | -------------------------------------------------------------------------------- 191 | 270 ssh ACTIVE FLOW NS 10.0.0.10[49402]/trust/6 (198.51.100.2[12607]) 192 | vsys1 198.51.100.1[22]/untrust (198.51.100.1[22]) 193 | reaper@PA-VM> show session all filter source 10.0.0.10 194 | 195 | No Active Sessions 196 | reaper@PA-VM> show counter global filter delta yes packet-filter yes 197 | 198 | Global counters: 199 | Elapsed time since last sampling: 54.857 seconds 200 | 201 | name value rate severity category aspect description 202 | -------------------------------------------------------------------------------- 203 | pkt_recv 3 0 info packet pktproc Packets received 204 | pkt_sent 14 0 info packet pktproc Packets transmitted 205 | flow_ip_cksm_sw_validation 9 0 info flow pktproc Packets for which IP checksum validation was done in software 206 | log_pkt_diag_us 100 1 info log system Time (us) spent on writing packet-diag logs 207 | -------------------------------------------------------------------------------- 208 | Total counters shown: 4 209 | -------------------------------------------------------------------------------- 210 | 211 | reaper@PA-VM> debug dataplane packet-diag set log off 212 | 213 | Packet log is disabled 214 | reaper@PA-VM> debug dataplane packet-diag aggregate-logs 215 | 216 | 217 | 218 | pan_packet_diag.log is aggregated 219 | 220 | 221 | reaper@PA-VM> set session offload yes 222 | 223 | reaper@PA-VM> less mp-log pan_packet_diag.log 224 | -------------------------------------------------------------------------------- /Chapter 7: Panorama example configuration: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | fnRL/G5lXVMug 14 | 15 | 16 | yes 17 | 18 | 19 | 20 | 21 | 22 | 23 |
24 | 25 | 203.0.113.0/24 26 | no 27 | 28 | 29 | 10.0.0.0/24 30 | 31 | 32 | 10.0.0.25 33 | 34 | 35 | sinkhole.paloaltonetworks.com 36 | 37 |
38 | 39 | 40 | 41 | AVforall 42 | 43 | 44 | AS 45 | 46 | 47 | strict 48 | 49 | 50 | default 51 | 52 | 53 | default 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | default 64 | 65 | 66 | 67 | no 68 | 69 | 70 | ISP 71 | 72 | 73 | any 74 | 75 | 76 | any 77 | 78 | 79 | sinkhole.paloaltonetworks.com 80 | 81 | 82 | any 83 | 84 | 85 | any 86 | 87 | 88 | any 89 | 90 | 91 | application-default 92 | 93 | 94 | any 95 | 96 | drop 97 | default 98 | 99 | 100 | 101 | 102 | default 103 | 104 | 105 | 106 | no 107 | 108 | 109 | LAN 110 | 111 | 112 | HQVPN 113 | 114 | 115 | HQ-admins 116 | 117 | 118 | any 119 | 120 | 121 | any 122 | 123 | 124 | any 125 | 126 | 127 | ssh 128 | 129 | 130 | application-default 131 | 132 | 133 | any 134 | 135 | allow 136 | 137 | SHARED 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | traffic 159 | All Logs 160 | yes 161 | 162 | 163 | threat 164 | All Logs 165 | yes 166 | 167 | 168 | url 169 | All Logs 170 | yes 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | 180 | 181 | default 182 | default 183 | 184 | 185 | default 186 | default 187 | 188 | 189 | default 190 | default 191 | 192 | 193 | default 194 | default 195 | 196 | 197 | default 198 | default 199 | 200 | 201 | default 202 | default 203 | 204 | 205 | default 206 | default 207 | 208 | 209 | 210 | 211 | 212 | 213 | 214 | 215 | 216 | disable 217 | 218 | 219 | 220 | 221 | 222 | disable 223 | 224 | 225 | 226 | 227 | 228 | 229 | pan-sinkhole-default-ip 230 | ::1 231 | 232 | 233 | 234 | 235 | 236 | 237 | 238 | 239 | critical 240 | high 241 | medium 242 | 243 | any 244 | any 245 | extended-capture 246 | 247 | 248 | 249 | 250 | 251 | 252 | low 253 | informational 254 | 255 | any 256 | any 257 | disable 258 | 259 | 260 | 261 | 262 | 263 | 264 | 265 | 266 | 267 | 268 | 10.0.0.150 269 | 255.255.255.0 270 | updates.paloaltonetworks.com 271 | 272 | 273 | 274 | 275 | 7 276 | download-and-install 277 | 278 | 279 | 280 | 281 | 282 | 283 | 4 284 | download-and-install 285 | 286 | 287 | 288 | 289 | 290 | 291 | 11 292 | download-and-install 293 | 294 | 295 | 296 | 297 | US/Pacific 298 | 299 | yes 300 | yes 301 | no 302 | 303 | Panorama 304 | 10.0.0.254 305 | 306 | 307 | 1.1.1.1 308 | 1.0.0.1 309 | 310 | 311 | 312 | 313 | time.nist.gov 314 | 315 | 316 | 317 | 318 | 319 | time.belnet.be 320 | 321 | 322 | 323 | 324 | 325 | 326 | mgmt 327 | 328 | 329 | 330 | 331 | 332 | 6 333 | 334 | 24 335 | 336 | 337 | 338 | 339 | 340 | 341 | 342 | 343 | 344 | 345 | 6 346 | 347 | 348 | 349 | 350 | no 351 | 22:00 352 | 353 | 354 | 355 | yes 356 | 357 | 358 | 359 | 360 | 361 | 362 | 363 | 364 | 12 365 | 366 | 3 367 | 368 | 369 | 370 | 371 | 372 | 373 | 374 | 375 | 376 | 377 | 378 | 379 | 380 | 381 | 382 | 383 | 384 | 385 | 386 | 10.0.0.21 387 | 22 388 | /backup 389 | backupadmin 390 | -AQ==fEqNCco3Yq9h5ZUglD3CZJT4lBs=TPKw8W+5h+VtffslpLSTkQ== 391 | 392 | 393 | 22:30 394 | yes 395 | 396 | 397 | 198.51.100.150 398 | 399 | 400 | 401 | 402 | 403 | 404 | FQDN 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | no 414 | no 415 | no 416 | no 417 | yes 418 | yes 419 | 420 | auto-negotiate 421 | 1500 422 | 423 | 424 | 425 | 426 | 427 | 428 | 429 | 430 | 431 | 432 | 433 | 434 | 435 | 436 | 437 | 438 | 439 | 440 | 441 | 442 | 443 | 444 | 445 | 446 | 447 | 448 | 449 | 450 | All remote offices 451 | 452 | 453 | 454 | 455 | 456 | 457 | default 458 | 459 | 460 | 461 | no 462 | 463 | 464 | LAN 465 | 466 | 467 | WAN 468 | 469 | 470 | PRTG 471 | 472 | 473 | any 474 | 475 | 476 | any 477 | 478 | 479 | any 480 | 481 | 482 | ping 483 | snmp 484 | 485 | 486 | application-default 487 | 488 | 489 | any 490 | 491 | allow 492 | 493 | FIELD 494 | 495 | 496 | 497 | 498 | 499 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | EMEA remote offices 508 |
509 | 510 | 198.51.100.0/24 511 | 512 |
513 | 514 | 515 | 516 | 517 | 518 | 519 | default 520 | 521 | 522 | 523 | no 524 | 525 | 526 | Untrust 527 | 528 | 529 | LAN 530 | 531 | 532 | any 533 | 534 | 535 | CloudNet 536 | 537 | 538 | any 539 | 540 | 541 | any 542 | 543 | 544 | ssl 545 | 546 | 547 | application-default 548 | 549 | 550 | any 551 | 552 | allow 553 | 554 | EMEA 555 | 556 | 557 | 558 | 559 | 560 | 561 | 562 | 563 | 564 | 565 | 566 | 567 | 568 | North America remote offices 569 | 570 | 571 | 572 | 573 | 574 | Asia Pacific Remote offices 575 | 576 | 577 | 578 | 579 | one stack to rule them all 580 | 581 | 582 | 583 | 584 | 585 | AdminTemplate 586 | Management Template 587 | Network Template 588 | 589 | 590 | 591 | 592 | 593 | 594 | 595 | 596 | 597 | 598 | -AQ==AbMHrLpPVPVar8M7sGu79sqAPpo=5Xsy3kFncZ/gYMLGP1hwUg== 599 | 600 | 601 | 602 | 603 | 604 | yes 605 | 606 | 607 | 608 | 609 | yes 610 | 611 | 612 | 613 | 614 | $test 615 | ethernet1/1 616 | 617 | 618 | 619 | no 620 | 621 | 622 | 623 | $test 624 | 625 | 626 | 627 | 628 | 629 | 630 | 631 | 632 | 633 | 634 | 635 | 636 | 637 | 638 | 639 | AdminTemplate 640 | Management Template 641 | Network Template 642 | 643 | 644 | 645 | 646 | 198.51.100.20/32 647 | 648 | 649 | 650 | 651 | 198.51.100.1/32 652 | 653 | 654 | 655 | 656 | 657 | 658 | 659 | 660 | 661 | 662 | 663 | 664 | -AQ==AbMHrLpPVPVar8M7sGu79sqAPpo=5Xsy3kFncZ/gYMLGP1hwUg== 665 | 666 | 667 | 668 | 669 | 670 | yes 671 | 672 | 673 | 674 | 675 | yes 676 | 677 | 678 | ikev2-preferred 679 | 680 | 681 | $test 682 | ethernet1/1 683 | 684 | 685 | 686 | no 687 | 688 | 689 | 690 | $HQFW 691 | 692 | 693 | 694 | 695 | 696 | 697 | 698 | 699 | 700 | 701 | 702 | 703 | 704 | 705 | 706 | 707 | AdminTemplate 708 | Management Template 709 | Network Template 710 | 711 | 712 | 713 | 714 | 715 | 716 | 717 | 718 | AdminTemplate 719 | Management Template 720 | Network Template 721 | 722 | 723 | 724 | 1017 | 1018 | 1019 | 1020 | 1021 | 1022 | 1023 | 1024 | 1025 | 1026 | 1027 | 1028 | 1029 | 1030 | ExampleSerial 1031 | 1032 | 1033 | 1034 | 1035 | 1036 | 1037 | 1038 | 1039 | 1040 | 1041 | 1042 | 11 1043 | 1044 | 1045 | 12 1046 | 1047 | 1048 | Field firewalls 1049 | 13 1050 | 1051 | 1052 | Field firewalls 1053 | 14 1054 | 1055 | 1056 | Field firewalls 1057 | 15 1058 | 1059 | 1060 | 1061 | 1062 | 16 1063 | 1064 | 1065 | 17 1066 | 1067 | 1068 | 18 1069 | 1070 | 1071 | 19 1072 | 1073 | 1074 | 1123 | 1124 | 1125 | 28 1126 | 1127 | 1128 | -------------------------------------------------------------------------------- /SharedGatewayExample: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | enable 12 | enable 13 | enable 14 | enable 15 | enable 16 | enable 17 | enable 18 | enable 19 | enable 20 | enable 21 | enable 22 | 23 | 24 | enable 25 | enable 26 | 27 | enable 28 | enable 29 | enable 30 | 31 | enable 32 | enable 33 | enable 34 | enable 35 | enable 36 | enable 37 | 38 | 39 | enable 40 | enable 41 | enable 42 | enable 43 | enable 44 | enable 45 | enable 46 | enable 47 | enable 48 | enable 49 | enable 50 | enable 51 | enable 52 | enable 53 | enable 54 | enable 55 | 56 | enable 57 | 58 | 59 | enable 60 | enable 61 | enable 62 | enable 63 | enable 64 | enable 65 | enable 66 | enable 67 | enable 68 | enable 69 | enable 70 | 71 | 72 | enable 73 | enable 74 | enable 75 | enable 76 | enable 77 | enable 78 | enable 79 | enable 80 | enable 81 | enable 82 | 83 | enable 84 | enable 85 | 86 | enable 87 | 88 | enable 89 | enable 90 | enable 91 | enable 92 | 93 | 94 | enable 95 | enable 96 | enable 97 | enable 98 | enable 99 | enable 100 | enable 101 | enable 102 | 103 | enable 104 | enable 105 | enable 106 | 107 | enable 108 | 109 | 110 | enable 111 | enable 112 | 113 | enable 114 | 115 | 116 | enable 117 | 118 | enable 119 | enable 120 | enable 121 | enable 122 | enable 123 | enable 124 | 125 | enable 126 | 127 | 128 | enable 129 | enable 130 | enable 131 | 132 | enable 133 | 134 | enable 135 | enable 136 | 137 | 138 | enable 139 | enable 140 | 141 | enable 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | no 152 | 153 | 154 | 155 | 156 | 157 | all 158 | 159 | 160 | 161 | 162 | 163 | 164 | business-systems 165 | collaboration 166 | general-internet 167 | 168 | 169 | general-business 170 | internet-conferencing 171 | management 172 | office-programs 173 | social-business 174 | software-update 175 | voip-video 176 | 177 | 178 | 1 179 | 2 180 | 3 181 | 182 | 183 | 184 | 185 | 186 | 187 | default 188 | 189 | 190 | strict 191 | 192 | 193 | strict 194 | 195 | 196 | default 197 | 198 | 199 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 209 | no 210 | 211 | 212 | 213 | 214 | 215 | no 216 | 217 | 218 | 219 | 220 | 221 | 222 | no 223 | 224 | 225 | no 226 | 227 | 228 | 229 | 230 | 231 | 232 | 233 | 234 | 235 | no 236 | 237 | 238 | no 239 | 240 | 241 | 242 | 243 | 244 | 245 | 246 | 247 | 248 | 249 | 250 | 251 | 252 | 253 | 254 | 255 | 256 | 257 | 258 | 259 | 260 | 261 | 3 262 | 5 263 | wait-recover 264 | 265 | 266 | 267 | 268 | 269 | 270 | 271 | 272 | aes-128-cbc 273 | 3des 274 | 275 | 276 | sha1 277 | 278 | 279 | group2 280 | 281 | 282 | 8 283 | 284 | 285 | 286 | 287 | aes-128-cbc 288 | 289 | 290 | sha256 291 | 292 | 293 | group19 294 | 295 | 296 | 8 297 | 298 | 299 | 300 | 301 | aes-256-cbc 302 | 303 | 304 | sha384 305 | 306 | 307 | group20 308 | 309 | 310 | 8 311 | 312 | 313 | 314 | 315 | 316 | 317 | 318 | aes-128-cbc 319 | 3des 320 | 321 | 322 | sha1 323 | 324 | 325 | group2 326 | 327 | 1 328 | 329 | 330 | 331 | 332 | 333 | aes-128-gcm 334 | 335 | 336 | none 337 | 338 | 339 | group19 340 | 341 | 1 342 | 343 | 344 | 345 | 346 | 347 | aes-256-gcm 348 | 349 | 350 | none 351 | 352 | 353 | group20 354 | 355 | 1 356 | 357 | 358 | 359 | 360 | 361 | 362 | aes-128-cbc 363 | 364 | 365 | sha1 366 | 367 | 368 | 369 | 370 | 371 | 372 | 373 | 374 | 375 | 376 | 377 | 378 | real-time 379 | 380 | 381 | high 382 | 383 | 384 | high 385 | 386 | 387 | medium 388 | 389 | 390 | medium 391 | 392 | 393 | low 394 | 395 | 396 | low 397 | 398 | 399 | low 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | no 412 | 413 | 414 | 1.25 415 | 0.5 416 | 900 417 | 300 418 | 900 419 | yes 420 | 421 | 422 | 423 | 424 | yes 425 | 426 | 427 | 428 | 429 | no 430 | 431 | 432 | no 433 | 434 | 435 | no 436 | 437 | 438 | 439 | ethernet1/1 440 | 441 | 442 | 443 | 444 | 445 | 446 | 447 | 448 | 449 | 450 | 451 | v2-default 452 | 453 | 454 | None 455 | 456 | 457 | no 458 | any 459 | 2 460 | 461 | 10 462 | 10.1.0.0/24 463 | 464 | 465 | 466 | 467 | 468 | 469 | no 470 | any 471 | 2 472 | 473 | 474 | sharedVR 475 | 476 | 477 | None 478 | 479 | 10 480 | 0.0.0.0/0 481 | 482 | 483 | 484 | 485 | 486 | 487 | 488 | 489 | 490 | 491 | 492 | 493 | 494 | 495 | 496 | 497 | 498 | 499 | yes 500 | 501 | 502 | no 503 | 504 | 505 | no 506 | 507 | 508 | no 509 | 510 | 511 | no 512 | 513 | 514 | 515 | ethernet1/2 516 | 517 | 518 | 519 | 520 | 521 | 522 | v1-default 523 | 524 | 525 | None 526 | 527 | 528 | no 529 | any 530 | 2 531 | 532 | 10 533 | 10.0.0.0/24 534 | 535 | 536 | 537 | 538 | 539 | 540 | no 541 | any 542 | 2 543 | 544 | 545 | sharedVR 546 | 547 | 548 | None 549 | 550 | 10 551 | 0.0.0.0/0 552 | 553 | 554 | 555 | 556 | 557 | 558 | 559 | 560 | 561 | 562 | 563 | 564 | 565 | 566 | 567 | 568 | 569 | 570 | yes 571 | 572 | 573 | no 574 | 575 | 576 | no 577 | 578 | 579 | no 580 | 581 | 582 | no 583 | 584 | 585 | 586 | 587 | 588 | 589 | 590 | 198.51.100.1 591 | 592 | 593 | None 594 | 595 | 596 | no 597 | any 598 | 2 599 | 600 | ethernet1/3 601 | 10 602 | 0.0.0.0/0 603 | 604 | 605 | 606 | 607 | 608 | 609 | no 610 | any 611 | 2 612 | 613 | 614 | v1-default 615 | 616 | 617 | None 618 | 619 | 10 620 | 10.0.0.0/24 621 | 622 | 623 | 624 | 625 | 626 | 627 | no 628 | any 629 | 2 630 | 631 | 632 | v2-default 633 | 634 | 635 | None 636 | 637 | 10 638 | 10.1.0.0/24 639 | 640 | 641 | 642 | 643 | 644 | 645 | 646 | 647 | ethernet1/3 648 | 649 | 650 | 651 | 652 | 653 | SharedGW 654 | 655 | 656 | 657 | 658 | ethernet1/3 659 | 660 | 661 | 662 | 663 | 664 | 665 | vsys1 666 | 667 | 668 | 669 | 670 | 671 | 672 | vsys2 673 | 674 | 675 | 676 | 677 | 678 | 679 | 680 | ethernet1/3 681 | 682 | 683 | 684 | 685 | 686 | 687 | 688 | 689 | 690 | 691 | ethernet1/3 692 | 198.51.100.2/24 693 | 694 | 695 | 696 | 697 | SGuntrust 698 | 699 | 700 | to-vsys1 701 | 702 | 703 | any 704 | 705 | 706 | any 707 | 708 | any 709 | 710 | 711 | 712 | 713 | 714 | ethernet1/3 715 | 198.51.100.2/24 716 | 717 | 718 | 719 | 720 | SGuntrust 721 | 722 | 723 | to-vsys2 724 | 725 | 726 | any 727 | 728 | 729 | any 730 | 731 | any 732 | 733 | 734 | 735 | 10.0.0.4 736 | 737 | 738 | SGuntrust 739 | 740 | 741 | SGuntrust 742 | 743 | 744 | any 745 | 746 | 747 | 198.51.100.4 748 | 749 | service-https 750 | 751 | 752 | 753 | 10.1.0.5 754 | 755 | 756 | SGuntrust 757 | 758 | 759 | SGuntrust 760 | 761 | 762 | any 763 | 764 | 765 | 198.51.100.5 766 | 767 | service-https 768 | 769 | 770 | 771 | 772 | 773 | 774 | 775 | 776 | 777 | 192.168.27.240 778 | 255.255.255.0 779 | updates.paloaltonetworks.com 780 | 781 | 782 | 783 | 784 | download-and-install 785 | 786 | 25 787 | 788 | 789 | 790 | 791 | 792 | download-and-install 793 | 794 | 5 795 | 796 | 797 | 798 | 799 | 800 | 45 801 | download-and-install 802 | 803 | 804 | 805 | 806 | US/Pacific 807 | 808 | yes 809 | yes 810 | 811 | PA-3020 812 | 192.168.27.1 813 | 814 | 815 | 1.1.1.1 816 | 1.0.0.1 817 | 818 | 819 | 820 | 821 | yes 822 | yes 823 | yes 824 | yes 825 | 826 | 827 | 828 | 829 | 830 | yes 831 | 832 | 833 | FQDN 834 | 835 | 836 | 837 | 838 | 839 | 840 | 841 | 842 | ethernet1/1 843 | ethernet1/1 844 | loopback 845 | tunnel 846 | vlan 847 | 848 | 849 | v1-default 850 | 851 | 852 | 853 | vsys2 854 | 855 | 856 | 857 | 858 | 859 | 860 | 861 | 862 | 863 | 864 | 865 | 866 | 867 | 868 | 869 | 870 | 871 | 872 | 873 | 874 | 875 | 876 | 877 | ethernet1/1 878 | 879 | 880 | 881 | 882 | 883 | 884 | vsys2 885 | 886 | 887 | 888 | 889 | 890 | 891 | sg1 892 | 893 | 894 | 895 | 896 | 897 | 898 | 899 | 900 | 901 | 902 | 903 | 904 | out-to-vsys2 905 | 906 | 907 | L3-trust-V1 908 | 909 | 910 | any 911 | 912 | 913 | any 914 | 915 | 916 | any 917 | 918 | 919 | any 920 | 921 | 922 | allowed 923 | 924 | 925 | application-default 926 | 927 | 928 | any 929 | 930 | allow 931 | 932 | 933 | default 934 | 935 | 936 | 937 | 938 | 939 | 940 | default 941 | 942 | 943 | 944 | to-SG-untrust 945 | 946 | 947 | L3-trust-V1 948 | 949 | 950 | any 951 | 952 | 953 | any 954 | 955 | 956 | any 957 | 958 | 959 | any 960 | 961 | 962 | allowed 963 | 964 | 965 | application-default 966 | 967 | 968 | any 969 | 970 | allow 971 | 972 | 973 | 974 | 975 | default 976 | 977 | 978 | 979 | L3-trust-V1 980 | 981 | 982 | to-SG-untrust 983 | 984 | 985 | any 986 | 987 | 988 | 198.51.100.4 989 | 990 | 991 | any 992 | 993 | 994 | any 995 | 996 | 997 | ssl 998 | 999 | 1000 | application-default 1001 | 1002 | 1003 | any 1004 | 1005 | allow 1006 | 1007 | 1008 | 1009 | 1010 | 1011 | 1012 | 1013 | no 1014 | 1015 | 1016 | 1017 | 1018 | 1019 | all 1020 | 1021 | 1022 | 1023 | 1024 | no 1025 | 1026 | 1027 | 1028 | 1029 | 1030 | all 1031 | 1032 | 1033 | 1034 | 1035 | 1036 | Beta environment 1037 | 1038 | 1039 | 1040 | 1041 | 1042 | 1043 | 1044 | 1045 | 1046 | ethernet1/2 1047 | 1048 | 1049 | 1050 | 1051 | 1052 | 1053 | vsys1 1054 | 1055 | 1056 | 1057 | 1058 | 1059 | 1060 | sg1 1061 | 1062 | 1063 | 1064 | 1065 | 1066 | 1067 | 1068 | ethernet1/7 1069 | ethernet1/2 1070 | 1071 | 1072 | v2-default 1073 | 1074 | 1075 | 1076 | vsys1 1077 | 1078 | 1079 | 1080 | 1081 | 1082 | 1083 | 1084 | 1085 | 1086 | 1087 | default 1088 | 1089 | 1090 | 1091 | out-to-vsys1 1092 | 1093 | 1094 | L3-trust-V2 1095 | 1096 | 1097 | any 1098 | 1099 | 1100 | any 1101 | 1102 | 1103 | any 1104 | 1105 | 1106 | any 1107 | 1108 | 1109 | allowed 1110 | 1111 | 1112 | application-default 1113 | 1114 | 1115 | any 1116 | 1117 | allow 1118 | 1119 | 1120 | 1121 | 1122 | default 1123 | 1124 | 1125 | 1126 | to-SG-untrust 1127 | 1128 | 1129 | L3-trust-V2 1130 | 1131 | 1132 | any 1133 | 1134 | 1135 | any 1136 | 1137 | 1138 | any 1139 | 1140 | 1141 | any 1142 | 1143 | 1144 | allowed 1145 | 1146 | 1147 | application-default 1148 | 1149 | 1150 | any 1151 | 1152 | allow 1153 | 1154 | 1155 | 1156 | 1157 | default 1158 | 1159 | 1160 | 1161 | L3-trust-V2 1162 | 1163 | 1164 | to-SG-untrust 1165 | 1166 | 1167 | any 1168 | 1169 | 1170 | 198.51.100.5 1171 | 1172 | 1173 | any 1174 | 1175 | 1176 | any 1177 | 1178 | 1179 | ssl 1180 | 1181 | 1182 | application-default 1183 | 1184 | 1185 | any 1186 | 1187 | allow 1188 | 1189 | 1190 | 1191 | 1192 | 1193 | 1194 | 1195 | 1196 | 1197 | --------------------------------------------------------------------------------