VOD-3741_Palo Alto Firewall Essentials.pdf

sadasd

1. Palo Alto Firewall Essentials
Course Introduction
ine.com

2. Piotr Kaluzny
CCIE #25665
[email protected]
linkedin.com/in/piotrkaluzny
CCIE Security

3. Course Prerequisites
+Basic Networking
concepts
+Basic Security concepts

4. Course Overview
+Module 1Platform Overview
+Module 2Management Access
+Module 3 Firewall Maintenance
+Module 4Firewall Basic Settings
+Module 5Firewall Interfaces
+Module 6Firewall Initialization

5. Palo Alto Firewall Essentials
Platform Overview
ine.com

6. Module Overview
+Introduction to Palo Alto
Firewall
+Platform types
+Processing architecture

7. +Next-generation prevention-focused security system
+User, Application, Content
+Key Capabilities
+User-ID, App-ID
+Zero Trust
+Security enforcement everywhere
+Advanced Threat Prevention
+IPS, URL Filtering, WildFire& DNS protection
+Advanced Logging
+Cortex Data Lake
+SD-WAN integration
Introduction to Palo Alto Firewall

8. +VM-Series
+Public Cloud
+Meet public cloud security obligations
+Private & Hybrid Clouds
+Secure virtualized compute resources & hypervisors
+Branches
+Isolate & protect critical systems
+DevOps
+Prisma Access
+Cloud-based firewall
Next-Generation Firewall Platforms

9. +Physical Appliances
+220, 800, 3200, 5200 & 7000 PA series
+https://www.paloaltonetworks.com/network-security/pa-series
Next-Generation Firewall Platforms

10. +Single-Pass Parallel Processing (SP3)
+Simultaneous traffic classification & enforcement
+Full-stack single-pass inspection
+Heavily reduces latency & increases performance
+Traffic Planes
+Palo Alto splits hardware resources between two traffic planes
+Control
+Configuration, logging, reporting
+Data
+Signature matching, security & network processing
Processing Architecture

11. Palo Alto Firewall Essentials
Management Access
ine.com

12. Module Overview+Management options
+Management port
+CLI

13. +Web Interface
+Local
+Centralized
+Panorama
+Panorama is recommended for networks with 6+ firewalls
+Reduces complexity and administration overhead
+Aggregates data from all managed devices
Management Options

14. +CLI
+Console, SSH, Telnet
+API
+XML
+REST
Management Options

15. +Special interface designed for administration
+Part of the Control Plane
+Preconfigured with 192.168.1.1/24 for HTTPS
+admin//admin
+Data ports also support management functions
+Management Profiles
+Service Routes
Management Port

16. +Required to provide access to external services through data ports
+Device > Setup > Services > Service Route Configuration > Customize
Service Routes

17. +Palo Alto firewalls use two CLI modes
+Operational
+Basic networking/system commands & verification
+E.g. ping, traceroute, show, debug
+Configuration
+Accessible via configure
+CLI Enhancements
+Use findto figure out the command syntax
+Use "?" to get help on command options and parameters
+Use the "Tab" key for command auto-completion
+Use the "|" symbol along with matchor exceptfor output filtering
Firewall CLI

18. Palo Alto Firewall Essentials
Firewall Maintenance
ine.com

19. Module Overview+Configuration files
+Updates

20. +Running Configuration
+Current configuration enforced in the Data Plane
+Controls the firewall's behavior
+Saved to running-config.xml
+Candidate Configuration
+Temporary configuration stored in the memory in the Control Plane
+Saved as either default snapshot.xml or as a custom XML file
+Saving candidate configuration does not activate the changes
+Requires a commit
+Turns candidate configuration into running configuration
Configuration Files

21. +Firewall configurations are managed using several options
+Revert to Last Saved Configuration
+Replaces current candidate configuration settings with a saved
candidate configuration file
+Revert to Running Configuration
+Replaces current candidate configuration settings with the current
running configuration
+Load
+Overwrites the current candidate configuration with a config file
+Export
+Exports a Current/Running Configuration file as an XML (backups)
+Import, Save
Configuration Files

22. +Keep the system up-to-date with latest threats, applications & more
+AntiVirus
+Including WildFiresignatures
+Applications, Applications and Threats
+GlobalProtectData File
+Host Information Profile (HIP) data
+GlobalProtectClientless VPN
+Enables clientless VPN access to common web applications from the
GlobalProtectportal
+PAN-DB URL Filtering
Dynamic Updates

23. +Used for scheduled PAN-OS code updates
+Require a system reboot
+Software can be downloaded manually or over the Management interface
Software Updates

24. Palo Alto Firewall Essentials
Firewall Basic Settings
ine.com

25. Module Overview+General configuration
+Admin roles

26. +Device -> Setup -> Management
+Hostname
+Domain
+Login Banner
+Device -> Setup -> Operations
+SNMP
+Device -> Setup -> Services
+DNS
+NTP
General Configuration

27. +Defines the type of access that an administrator has to the firewall
+Dynamic
+Based on pre-built profiles
+E.g. Superuser, Superuser (read-only), Device administrator
+Role Based
+Custom access for granular control
+Configuration
+Device -> Administrators
+Device -> Admin Roles
Admin Roles

28. Palo Alto Firewall Essentials
Firewall Interfaces
ine.com

29. Module Overview+Datainterfaces
+Other interfaces

30. +PAN-OS supports several types of interfaces and can operate in
multiple deployments
+Tap, Virtual Wire, Layer 2, Layer 3
+Tap
+Works on a copy of network traffic
+Port mirroring (SPAN)
+Deployed for logging & visibility
Data Interfaces

31. +Virtual Wire
+For inline deployments
+Traffic control, decryption, QoS, etc.
+A logical connection of two ports
+No L2/L3 addresses
+No management capabilities
+Easy to integrate
+Allows for subinterfaces
+Virtual Wire interfaces must be attached to a Virtual Wire Object
+Default Virtual Wire ports may need to be removed
Data Interfaces

32. +Layer 2
+Used for L2 switching
+Inline
+Require a VLAN Object
+Support subinterfaces
+Layer3
+Used for L3 routing (IPv4, IPv6)
+Inline
+Require a Virtual Router
+Support subinterfaces& management
Data Interfaces

33. +Loopback
+Virtual L3 ports internal to the firewall
+Used in many scenarios
+Routing, DNS Sinkholes & more
+Tunnel
+Virtual interface used for VPN representation
Other Interfaces

34. Palo Alto Firewall Essentials
Firewall Initialization
ine.com

35. Module Overview+Virtual routers
+Security zones

36. +Enables routing functions
+Interfaces
+RIB
+Control Plane
+FIB
+Data Plane
+Supported Routing Technologies
+Static routes
+OSPF, OSPFv3, BGP, RIP
+PIM-SM, PIM-ASM, PIM-SSM, IGMP version 1/2/3
Virtual Router

37. +A group of interfaces representing a segment controlled by the firewall
+LAN1, Internet, etc.
+A firewall interface can belong to only one zone
+Interface Type & Zone Type must match
+Zone-unassigned interface does not process traffic
+Zones affects the data traffic
+Intra-zone
+Inter-zone
Security Zone