Tuesday, 1 July 2025

Palo alto PCNSA notes

Palo alto firewall

Palo alto is next gen firewall with user-id and app-id. Dynamic lists/feeds (EDL) for blocking malicious traffic and allowing trusted traffic like azure and CDNs etc.

It can do its inspections on north/south traffic and east/west traffic.

It has IPS, URL, wildfire (unknown threats).

DNS sinkhole (DNS protection)

Advanced logging with cortex datalake (take in multiple log sources and apply machine learning)


Platforms

  • Virtual machines for public and private cloud (you control the VM)
  • Prisma access (hosted cloud based firewall as a  service)
  • Physical devices (physical boxes to install on site)

https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations


SP3

Single pass simultaneous traffic inspection, classification and enforcement in one pass

Traffic 

Control plane

  • config 
  • logging 
  • reporting 

Data plane

  • Signature matching 
  • security and network processing 

Management options
  • Web interface HTTPS over the network or MGMT port
  • CLI via SSH over the network or via console cable
  • Panorama - centralized platform for managing multiple firewalls. Good for MSP. 6+ devices.
  • API - XML REST based API. Good for automation and network programming
The management GUI on box help
There is an onbox documentation, usually in the top right

ACC - Application Command Centre
Analytical tool to provide actionable intelligence about network activity. Shows trends etc.

Monitor tab
  • Live logs
  • Reports

Policies 
  • Firewall / NAT rules etc

Objects
  • Setup objects for use in policies

Network
  • data plane interfaces and zones
  • VPN related items
Device
  • General settings
  • Management interface
  • User accounts
  • Licenses
  • Config backup
Management port is part of the control plane
Default 192.168.1.1/24
HTTPS
default user: admin/admin
We can disable it if needed and use network interface
By default dataplane ports won't accept mgmt packets

Service routes
For all items we need to reach out of the firewall for eg radius / log forwarding etc. 
By default it will use the mgmt port
Device > Setup > Services > Service Router Configuration > Customize 

CLI modes
  • Operational - basic network commands: ping traceroute, show, debug
  • Configuration - configure command, now you can make changes
  • Similar to cisco in that regard
CLI enhancements
  • User find to figure out the command syntax
  • use ? to get help
  • User tab to autocomplete
  • Use | pipe with match or except for output filtering
ping "tab"
We will sett options with symbols
+ count - plus means it needs a value
* host - * means its required
> - means you will have more options after

ping host 1.1.1.1

tail - useful for log messages

set is how we do some config 
show is how we show the config

Find all the commands related to the network
find command keyword network

W can see ethernet is under interface under network. To change ethernet1/1 from cli we need to use:
set network interface ethernet1/1

CLI is good for checking and debugging but most config will be done via CLI now

Firewall maintenance

Config files

Running config (running-config.xml)
sits in the dataplane and this one controls the firewall behaviour
When the firewall reboots this config is loaded when it boots up 


Candidate configuration (snapshot.xml)
Separate file/space in memory to store temporary configuration in the control plane
Its config we have configured but have not deployed yet. 
When we do a commit its merged into running config.
Saving the candidate config doesn't commit the changes

Candidate config is the running config + the new changes
Commit command merges the changes from candidate config into running config
New updated running config has the new changes

We can revert to last saved conf
Replaces current candidate config with a saved candidate config file

We can revert to running config (probably will use this one most)
Get rid of un-commited changes

Load 
over writes with a file saved earlier (usually from a backup, used when restoring) 

Save
Can save a named config snapshot.

Export
Export a named config (backup)

Dynamic updates
  • Make sure these are enabled and auto downloading / installing 
  • Antivirtus / Wildfire 
  • Apps and threats 
  • Global protect HIP
  • PAN-DB URL filtering (may use umbrella instead)


Wednesday, 18 June 2025

VMware remote console VMRC

 https://knowledge.broadcom.com/external/article/368995/download-vmware-remote-console.html

Wednesday, 4 June 2025

Cisco RMA steps

open case 

request RMA

enter serial

chat now

Can I request RMA for this serial number : xxxxxxx

creates a RMA ticket

address needs to have customer name (your address / eircode)

or ship the RMA to the customer site

Friday, 7 March 2025

export user cert from windows cert store

Open MMC 

Add certs snap-in

user account and computer store

Check certificates > personal

exported the user cert from user store (use PKCS12 or DER base-64 encoded)

imported user cert into machine

switch aaa and radius authentication settings for duo etc

 aaa group server radius DUO-AUTH

aaa authentication login default group DUO-AUTH local

aaa authentication login CON-LOCAL local



aaa group server radius DUO-AUTH

 server name DUO-AUTH-PROXY

 ip radius source-interface Vlan2


radius server DUO-AUTH-PROXY

 address ipv4 192.168.1.1 auth-port 18122 acct-port 18122

 pac key 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx


Wednesday, 5 March 2025

find what DH group an ikev1 S2S VPN is using in ASA

Move away from Groups 2, 5, 24. 

DH Groups 2, 5, 24 are considered insecure and are deprecated in FTD’s running 6.5/6.6 and will be removed in a later version.

check 6.7 and 7.1 release notes and search for group 5

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/vpn-s2s.html? 


IKEv1

show vpn-sessiondb detail l2l filter ipaddress x.x.x.x

Look for "D/H Group" in IKEv1 section

sh crypto isakmp sa detail | i Grp:


sh crypto isakmp sa | i PFS Group 2,

Looking for groups 2 and 5

 sh crypto isakmp sa detail | i Grp:2,

 sh crypto isakmp sa detail | i Grp:5,


Can copy the full output of " sh crypto isakmp sa detail" to a text file and search

Tuesday, 4 March 2025

QoS palo alto

Make QoS policies

Policies > QoS


Assign policies to a profile:

Network > Network Profiles > QoS Profile


Assign a profile to interfaces

Network > QoS