Difference between revisions of "PAN-OS"
Jump to navigation
Jump to search
(→PAN-OS CLI: * <code>show jobs id x</code>) |
|||
| Line 69: | Line 69: | ||
** https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin | ** https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin | ||
* Read PAN-OS 9.0 New features guide: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features.html such as Rule Changes Archive <ref>https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/management-features/rule-changes-archive.html</ref> | * Read PAN-OS 9.0 New features guide: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features.html such as Rule Changes Archive <ref>https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/management-features/rule-changes-archive.html</ref> | ||
| − | * Read PAN-OS | + | * Read [[PAN-OS Release Notes]] |
* Review PAN-OS CLI Quick Start: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-cli-quick-start/cli-cheat-sheets.html | * Review PAN-OS CLI Quick Start: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-cli-quick-start/cli-cheat-sheets.html | ||
* Read Palo Alto basics of [[Palo Alto traffic monitoring filtering]]: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSlCAK | * Read Palo Alto basics of [[Palo Alto traffic monitoring filtering]]: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSlCAK | ||
Revision as of 05:18, 8 January 2020
PAN-OS is software running on Palo Alto firewalls.[1] providing Firewall capabilities, QoS, URL Filtering, packet inspection and threat prevention (WildFire).
- Threat prevention (Wildfire). Features: https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/wildfire-features-in-panos-90.html
- PAN-OS daemons: RASMGR, SSLMGR, SATD, IDE, Route and IKE
PAN-OS CLI
configurecommitshowshow system infoshow system stateshow system disk-space filesless mp-log authd.logshow routing routeshow running nat-policy(See also: https://en.wikiversity.org/wiki/Cisco_Networking/CCENT/Network_Services#NAT_Configuration)show running security-policyshow jobs id xedit rulebase securityedit rulebase nat
PVST+ commands
Troubleshooting
ping host <destination-ip-address>ping source <ip-address-on-dataplane> host <destination-ip-address>show netstat statistics yes
Panorama
show log-collector preference-listshow logging-status device <firewall-serial-number>
Logs
Wildfire
show wildfire wf-vm-pe-utilizationshow wildfire wf-vm-doc-utilizationshow wildfire wf-vm-elinkda-utilizationshow wildfire wf-vm-archive-utilizationshow wildfire global sample-device-lookup sha256 equal <SHA_256>.show wildfire local sample-processed {time [last-12-hrs | last-15-minutes | last-1-hr | last-24-hrs | last-30-days | last-7-days | last-calender-day | last-calender-month] \ count <number_of_samples>}.
Rules
set rulebase security rules YOUR_RULES_NAMES from Untrust to Trust source any destination any application any service any action allowmove rulebase security rules YOUR_RULE_NAME topmove rulebase security rules YOUR_RULE_NAME before YOUR_OTHER_RULE_NAMEdelete rulebase security rules YOUR_RULE_NAME
NAT (Valid actions: top, bottom, before, after)
set rulebase nat rules YOUR_RULE_NAME source-translation dynamic-ip-and-port interface-address interface ethernet1/2move rulebase nat rules YOUR_RULE_NAME topdelete rulebase nat rules YOUR_RULE_NAME
Activities
Basic
- Review additional PAN-OS examples: https://www.thegeekstuff.com/2019/06/paloalto-cli-security-nat-policy/
- Create a backup of your configuration: https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/9-0/pan-os-admin/firewall-administration/manage-configuration-backups.html
- Read PAN-OS 9.0 Administration guide:
- Read PAN-OS 9.0 New features guide: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features.html such as Rule Changes Archive [2]
- Read PAN-OS Release Notes
- Review PAN-OS CLI Quick Start: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-cli-quick-start/cli-cheat-sheets.html
- Read Palo Alto basics of Palo Alto traffic monitoring filtering: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSlCAK
Intermediate
- Create a IPSec VPN access in tunnel mode (transport mode not supported): https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK
- Configure MFA: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/authentication/configure-multi-factor-authentication.html
- Configure syslog monitoring https://www.manageengine.com/products/firewall/help/configure-paloalto-firewalls.html
See also
- DMZ, Port knocking, Bastion host, Firewall Software:
iptablesufwfirewalldnftablesfirewall-cmdipfw (FreeBSD)PF (OpenBSD), netsh advfirewall, PAN-OS, WAF, pfsense, VyOS, Cisco ASA, DMZ, F5, URL Filtering, port forwarding, macOS application firewall, Windows firewall, Fortigate, ngrok, Network ACL - PAN-OS (Palo Alto): PAN-OS Releases,
show vpn, GlobalProtect, GlobalProtect logs, WildFire,show log,show session all, MDM,match, PAN-OS reports, HIP, Zone - Cisco IOS, PAN-OS, Junos OS, FortiOS
- Terraform PAN-OS: https://www.terraform.io/docs/providers/panos/index.html
Draft - Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. https://en.wikiversity.org/wiki/Draft:Firewall/Palo_Alto_PA-Series/PAN-OS
Advertising:
