Difference between revisions of "PAN-OS"

From wikieduonline
Jump to navigation Jump to search
 
(12 intermediate revisions by the same user not shown)
Line 1: Line 1:
PAN-OS is software running on [[Firewall/Palo Alto PA-Series|Palo Alto firewalls]].<ref>https://docs.paloaltonetworks.com/pan-os</ref> providing:
+
[[wikipedia:PAN-OS]] is software running on [[Firewall/Palo Alto PA-Series|Palo Alto firewalls]].<ref>https://docs.paloaltonetworks.com/pan-os</ref>.
* [[Firewall]] capabilities
+
 
 +
 
 +
== Features ==
 +
* [[Firewall]] capabilities: [[Flood protection]]
 
* [[QoS]]
 
* [[QoS]]
 
* [[URL Filtering]] (License based)
 
* [[URL Filtering]] (License based)
* [[GlobalProtect]] ([[VPN]])
+
* [[File blocking]]
 +
* [[GlobalProtect]] Gateway ([[VPN]]) (License based)
 
* [[packet inspection]]
 
* [[packet inspection]]
* [[Threat prevention]] ([[WildFire]]), features: https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/wildfire-features-in-panos-90.html
+
* [[Threat prevention]] ([[WildFire]]) (License based), features: https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/wildfire-features-in-panos-90.html
 
* PAN-OS authentication methods: [[Kerberos]], [[RADIUS]], [[LDAP]], [[SAML]] 2.0, client certificates, biometric sign-in, and a local user database
 
* PAN-OS authentication methods: [[Kerberos]], [[RADIUS]], [[LDAP]], [[SAML]] 2.0, client certificates, biometric sign-in, and a local user database
 
* PAN-OS daemons: [[RASMGR]], [[SSLMGR]], [[SATD]], [[IDE]], [[Route]] and [[IKE]]
 
* PAN-OS daemons: [[RASMGR]], [[SSLMGR]], [[SATD]], [[IDE]], [[Route]] and [[IKE]]
Line 16: Line 20:
 
* <code>show</code>
 
* <code>show</code>
 
* <code>[[show session all]]</code>
 
* <code>[[show session all]]</code>
 +
* <code>[[show session info]]</code>
 
* <code>[[show system info]]</code> (Includes <code>sw-version</code> output and [[serial]])
 
* <code>[[show system info]]</code> (Includes <code>sw-version</code> output and [[serial]])
 
* <code>[[show system state]]</code>
 
* <code>[[show system state]]</code>
 +
* <code>[[show system resources]]</code>
 
* <code>show system disk-space files</code>
 
* <code>show system disk-space files</code>
 
* <code>less mp-log authd.log</code>
 
* <code>less mp-log authd.log</code>
 
* <code>[[show routing route]]</code>
 
* <code>[[show routing route]]</code>
* <code>show running [[nat]]-policy</code> (See also: https://en.wikiversity.org/wiki/Cisco_Networking/CCENT/Network_Services#NAT_Configuration)
+
* <code>[[show running]] [[nat]]-policy</code> (See also: https://en.wikiversity.org/wiki/Cisco_Networking/CCENT/Network_Services#NAT_Configuration)
 
* <code>[[show running security-policy]]</code>
 
* <code>[[show running security-policy]]</code>
 +
* <code>[[show counter]] global filter delta yes packet-filter yes</code>
 
* <code>show jobs id x</code>
 
* <code>show jobs id x</code>
 
* <code>edit rulebase security</code>
 
* <code>edit rulebase security</code>
 
* <code>edit rulebase nat</code>
 
* <code>edit rulebase nat</code>
 +
  
 
===[[VPN]]===
 
===[[VPN]]===
Line 70: Line 78:
 
{{GlobalProtect commands}}
 
{{GlobalProtect commands}}
  
 +
 +
=== [[License]] ===
 +
* <code>[[request license info]]</code>
  
 
=== Others ===
 
=== Others ===

Latest revision as of 08:16, 31 August 2021

wikipedia:PAN-OS is software running on Palo Alto firewalls.[1].


Features[edit]


PAN-OS CLI[edit]


VPN[edit]

PVST+ commands

Troubleshooting[edit]

  • ping host <destination-ip-address>
  • ping source <ip-address-on-dataplane> host <destination-ip-address>
  • show netstat statistics yes
  • test authentication authentication-profile <AUTHENTICATION-PROFILE-NAME> username <USERNAME> password

Panorama[edit]

  • show log-collector preference-list
  • show logging-status device <firewall-serial-number>

Logs[edit]

Wildfire[edit]

  • show wildfire wf-vm-pe-utilization
  • show wildfire wf-vm-doc-utilization
  • show wildfire wf-vm-elinkda-utilization
  • show wildfire wf-vm-archive-utilization
  • show wildfire global sample-device-lookup sha256 equal <SHA_256>.
  • show wildfire local sample-processed {time [last-12-hrs | last-15-minutes | last-1-hr | last-24-hrs | last-30-days | last-7-days | last-calender-day | last-calender-month] \ count <number_of_samples>}.

Rules[edit]

  • set rulebase security rules YOUR_RULES_NAMES from Untrust to Trust source any destination any application any service any action allow
  • move rulebase security rules YOUR_RULE_NAME top
  • move rulebase security rules YOUR_RULE_NAME before YOUR_OTHER_RULE_NAME
  • delete rulebase security rules YOUR_RULE_NAME

NAT (Valid actions: top, bottom, before, after)

  • set rulebase nat rules YOUR_RULE_NAME source-translation dynamic-ip-and-port interface-address interface ethernet1/2
  • move rulebase nat rules YOUR_RULE_NAME top
  • delete rulebase nat rules YOUR_RULE_NAME

GlobalProtect[edit]

current-satellite Show current GlobalProtect gateway satellites
current-user Show current GlobalProtect gateway users
flow Show dataplane GlobalProtect gateway tunnel information
flow-site-to-site Show dataplane GlobalProtect site-to-site gateway tunnel information
gateway Show list of GlobalProtect gateway configuration
previous-satellite Show previous GlobalProtect gateway satellites
previous-user Show previous user session for GlobalProtect gateway users


License[edit]

Others[edit]

Activities[edit]

Basic[edit]


Intermediate[edit]

NAT

Related terms[edit]

See also[edit]

Manual: https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin.html

Draft - Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. https://en.wikiversity.org/wiki/Draft:Firewall/Palo_Alto_PA-Series/PAN-OS

Advertising: