Palo alto firewall
Palo alto is next gen firewall with user-id and app-id. Dynamic lists/feeds (EDL) for blocking malicious traffic and allowing trusted traffic like azure and CDNs etc.
It can do its inspections on north/south traffic and east/west traffic.
It has IPS, URL, wildfire (unknown threats).
DNS sinkhole (DNS protection)
Advanced logging with cortex datalake (take in multiple log sources and apply machine learning)
Platforms
- Virtual machines for public and private cloud (you control the VM)
- Prisma access (hosted cloud based firewall as a service)
- Physical devices (physical boxes to install on site)
https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations
SP3
Single pass simultaneous traffic inspection, classification and enforcement in one pass
Traffic
Control plane
Data plane
- Signature matching
- security and network processing
Management options
- Web interface HTTPS over the network or MGMT port
- CLI via SSH over the network or via console cable
- Panorama - centralized platform for managing multiple firewalls. Good for MSP. 6+ devices.
- API - XML REST based API. Good for automation and network programming
The management GUI on box help
There is an onbox documentation, usually in the top right
ACC - Application Command Centre
Analytical tool to provide actionable intelligence about network activity. Shows trends etc.
Monitor tab
Policies
Objects- Setup objects for use in policies
Network
- data plane interfaces and zones
- VPN related items
Device
- General settings
- Management interface
- User accounts
- Licenses
- Config backup
Management port is part of the control plane
Default 192.168.1.1/24
HTTPS
default user: admin/admin
We can disable it if needed and use network interface
By default dataplane ports won't accept mgmt packets
Service routes
For all items we need to reach out of the firewall for eg radius / log forwarding etc.
By default it will use the mgmt port
Device > Setup > Services > Service Router Configuration > Customize
Lots of these settings are not sync'd like NTP so have to config on both palo1 and palo2
Don't forget to set timezone
CLI modes
- Operational - basic network commands: ping traceroute, show, debug
- Configuration - configure command, now you can make changes
- Similar to cisco in that regard
CLI enhancements
- User find to figure out the command syntax
- use ? to get help
- User tab to autocomplete
- Use | pipe with "match" or "except" for output filtering
ping "tab"
We will sett options with symbols
+ count - plus means it needs a value
* host - * means its required
> - means you will have more options after
ping host 1.1.1.1
tail - useful for log messages
set is how we do some config
show is how we show the config
Find all the commands related to the network
find command keyword network
W can see ethernet is under interface under network. To change ethernet1/1 from cli we need to use:
set network interface ethernet1/1
CLI is good for checking and debugging but most config will be done via CLI now
Firewall maintenance
Config files
Running config (running-config.xml)
sits in the dataplane and this one controls the firewall behaviour
When the firewall reboots this config is loaded when it boots up
Candidate configuration (snapshot.xml)
Separate file/space in memory to store temporary configuration in the control plane
Its config we have configured but have not deployed yet.
When we do a commit its merged into running config.
Saving the candidate config doesn't commit the changes
Candidate config is the running config + the new changes
Commit command merges the changes from candidate config into running config
New updated running config has the new changes
We can revert to last saved conf
Replaces current candidate config with a saved candidate config file
We can revert to running config (probably will use this one most)
Get rid of un-commited changes
Load
over writes with a file saved earlier (usually from a backup, used when restoring)
Save
Can save a named config snapshot.
Export
Export a named config (backup)
Dynamic updates
- Make sure these are enabled and auto downloading / installing
- Antivirtus / Wildfire
- Apps and threats
- Global protect HIP
- PAN-DB URL filtering (may use umbrella instead)
Palo alto policy types
- Security (firewall rules etc)
- NAT (global NAT, NoNats, public NATs etc)
- QoS (voice QoS)
- Policy based forward (PBR)
- Decryption (SSL)
- Authentication ( radius / SAML etc)
- DoS protection
- Tunnel Inspection
- SD-WAN
Palo alto works like ASA
works from top to bottom
when rule is match traffic is dispatched
it doesn't check any futther rules
Security policies
- The primary traffic control tool
- Block rules at top like block lists, implicit deny at the bottom.
- Add the most specific rules at the top
IntERzone vs IntRAzone
- IntERzone (lan to dmz)
- IntRAzone (same zone)
- Universal (interzone + intrazone combined)
Application/Service
- select (pick which ports)
- any (allow HTTP on any port for example)
- application-default (web-browsing only allowed on default ports 80/443 but not 8881)
Generally we don't want to allow apps on lots of ports but some custom applications run HTTP etc on non standard ports.
- applicaiton-default - use this where we can as first preference
- select - in edge cases we can config the specific ports. Second choice.
- any - only for testing or we can't get it working any other way. Last resort.
Default rules can be changed by using the override button.
Policy objects / groups
Its efficient to group items into groups so later the groups can be updated but your firewall rules can remain unchanged.
Security profiles
ping command source from inside to host
ping source 192.168.10.100 host 192.168.10.50
however if the clients try to ping the firewall it will fail by default. We would need to create a management profile, allow ping and apply it to that interface.
ACLs can be found under
Policies > Security
We can see applications ping and icmp
icmp is for the full protocol (except for ping)
ping is the ping app which is under icmp protocol
How to block web comms to a specific IP
NAT
- Allows network devices to change source/destination of packets.
- Main function for IPv4 depletion but has other uses.
- In most orgs its used to hide all clients behind a single IP for internet access (NAT overload)
- The other main use is to give servers a static public IP
- NoNAT's are used for S2S VPNs
SNAT - source NAT
DNAT - destination
Some devices allow changing source and destination at the same time
Static NAT is to map one IP to one IP
Dynamic is IP that gets mapped can come from pool of IP's. Dynamic includes port translations
On palo alto we have a NAT policy
- A NAT rule has 3 main sections:
- General
- Original packet
- Translated packet
NAT type: IPv6 / IPv6
Original packet is how we select the original packet
Translated packet is what we want to change it to
Rules can refer to address objects instead of IPs
It's recommended to use objects in case the IP is updated later.
- NAT Rule processing is top down
- Applies regardless of NAT type
- Most specific rules at top
- More general NAT's at the bottom
- No NAT rule can go at the top (exemptions)
IP addresses should always refer to the original IP's, pre-NAT
Use the original IP in the firewall rules as well.
Remember NAT does the translation but it doesn't allow or deny anything. That is the job of the security policy.
test routing fib-lookup virtual-router default ip 192.168.57.31
Will give you the interface it will go out.
show routeing route
Shows all routes
Working with NAT
Policies > NAT
In some cases we might need to adjust routes
For example when you need to NAT to an external IP block
In the case there is one public IP range configured on the outside of the firewall
A second block/pool has been added on later. In this case the firewall doesn't know about it.
Like an extra IP block
You may need to adjust routing so traffic knows how to get back to the firewall.
Verify and TS
Device > troubleshooting > NAT policy match
Rule usage, check hit counts / last hit / fist hit
CLI
- show session all
- show running ippool
- show system state | match nat
Goal is to enable dynamic NAT with a pool for any inside network
This will be source NAT (SNAT)
As the traffic leaves we will change the source to something else
First create your object with your public IP pool.
Name: DPOOL
IP netmask: 192.0.2.0/24
Policies > NAT
Add rule
Give a name
SRC: IN
DST: OUT
Go to translated packet
Change source to dynamic IP
select: DPOOL
NAT policy doesn't automatically allow the traffic. You will need a security policy rule as well.
You may need to have a route setup to route back.
Goal expose a DMZ device to the internet
This will be destination translation from outside to outside
Palo NAT works on addresses and zones from the original packet, that is why we do outside > outside and not outside > dmz.
NAME: STATIC
SEC: OUT
DEST: OUT
DEST ADDR: 102.0.2.230
Translated packet
Source translation: none
Destination translation type: static IP
Translated address: 192.168.57.31
We don't need bi directional here because the firewall will allow the return traffic.
Again you will need security policy to allow the traffic
In the security policy it applies after translation. So we will need OUTSIDE > DMZ, even though the address belongs to outside.
NAT policy: original packet (outside to outside)
Security policy: after translation (outside to DMZ)
Logging and monitoring
logs are timestamped events, often including useful information src/dst IP etc.
Important log types but there are more
- Traffic - src/dst IP, ports, app, nat
- Threat - details on detected threats
- Config/Audit - what changes admin made
- System - the PAN os system
- User-ID - details about user ID
- Global protect - the dial in VPN logs
Log settings
- Session start - log at the first packet (useful for UDP and sessions that never fully setup/close)
- Session end - log when the tcp connection has closed
- Log forwarding - send logs to external syslog server/SIEM etc. The firewall can only store so much.
- Logs can be filtered
- Log profile defines the external log server
- Log forwarding is where we define what logs we will send
Enhanced logging
We can collect additional data for cortex XDR. You need data lake subscription
Config
Device > server profiles > syslog
Add profile
SYSLOG-PROF
fill in IP of syslog server 192.168.100.50
Device > Setup > Services
Make sure you use the right interface for syslog, often picking inside/lan interface
Objects > Log Forwarding
LOG-FWD
pick traffic and select SYSLOG-PROF
Log settings
under config logs do the same
In our rules set the logging settings as needed (session start vs session end)
If we need to override the default rule, log at session end
Set log forwarding
Advanced policies
QoS - a set of tech that we can enable to control traffic bandwidth/latency/jitter etc.
Palo can do classification on packets based on the user and app
Bandwidth mgmt - limit/guarantee bandwidth for certain apps/flows
Priority queuing - voice traffic gets processed first
example classification
- voice/teams
- business critical apps
- everything else
Default profile is just for prioritization
Policies > QoS
Class 4 is the default
We can use DSCP and/or ToS marking that may have been done by other netwok devices and honor them or change them as you need
Use post NAT address in QoS (like in security access policy)
QoS is processed top down and exits on rule match
QoS is outbound/Egress feature. Affects outbound interface only
To limit downloads from the internet, apply QoS in inside interface (egress to inside/LAN)
To limit uploads , apply QoS to outside interface (egress to internet)
Turn QoS on the interface
Physical vs clear text vs tunnelled interface
Egress max is the max speed of the interface.
If a class has egress max 0, the value of egrees max will be used
When we guarantee bandwidth its only kicking in, in the event of congestion
Classes with no guarentee'd bandwidth will show a guarantee of 0.001 mbps
Steps
Create QoS policy
Create QoS profiles
Don't forget to commit
After applying check the statistics
Decryption
Decryptions allows the firewall to look inside encrypted connections like HTTPS connections
We may detect malware coming across the encrypted flow and we can block
If we don't decrypt we are not able to detect it in transit and would hope the endpoint AV will catch it
Some traffic can't / shouldn't be decrypted
SSL/TLS decryption (man in the middle)
SSL forward proxy (outbound traffic)
Certs needed:
- Forward trust
- Forward untrust
Client < > (SSL decrypt) FW (SSL decrypt) < > internet > Server
- When client starts a connection, the firewall intercepts the connection setup
- The firewall impersonates the server.
- The firewall does the same to the server, impersonates the client
- The client thinks its talking to the server but its talking to the firewall
- The server thinks its talking to the client but its talking to the firewall
- The firewall joins both ends but is able to look inside the connection
SSL Inbound inspection
Applies to inbound traffic, usually to your public servers
Internet > HTTPS > FW > DMZ > Web server
In this method we install the certs from our servers on the firewall.
SSH decryption
We don't need certs
Useful to find people using SSH port forwarding x11 or TCP connections
Decryption mirror
We can copy decrypted traffic to a destination on an interface. The traffic gets sent 1 way out to be logg or inspected by another system
Decryption broke
Firewall still decrypts but only sends the allowed traffic to other devices for additional inspection
FW > C-TXT > SC1 > SC2 > remaining allowed traffic goes back to the firewall
Decryption exclusions
Some apps can't be decrypted. Some compliance / regulation means we can't decrypt banking and health data as its private.
Decryption certs
- Forward trust cert - needs to be trusted by enpoints
- Forward untrust cert - should not be trusted because we want to represent untrusted destinations
- SSL inbound certs will - install the certs/private key from your pubic servers on the firewall
Decryption profile
We can set extra options on how to handle sites that have expired or old ciphers etc
Define sites to decrypt by zone, user, but you will probably use URL category the most
In new infra make a NoDecrypt URL category and choose to decrypt everything else.
For existing infra you will want to move gradually, start with some non critical sites or test users
Device > certificate management > SSL decryption exclusion
Disable decryption temporarily via CLI
- set system setting ssl-decrypt skip-ssl-decrypt yes
The command applies immediately, does not need commit. You can test your site/rule ssldecrypt in/out of your issue
Turn it back on
set system setting ssl-decrypt skip-ssl-decrypt no
Checking logs in the GUI:
Checking logs on the CLI:
- show session all filter ssl-decrypt yes
- show counter global | match proxy
If the session is decrypted we should see a * in the flag field. If its blank we did not do decryption
ACTIVE FLOW * 192.168.100.50
SSH decryption
Create a decryption policy with the action set to SSH proxy
To see if SSH is tunneling traffic we need to decrypt
Normal SSH traffic is SSH, SCP, SFTP
In you security rule allow the the app ssh but block ssh-tunnel
Example rule order
- NoDecrypt / exclusion list
- HTTPS decrypt
- SSH decrypt
Tunnel inspection
Looking at content of cleartext pass through tunnels
- GRE (generic Routing Encapsulation)
- IPsec (ESP with null encryption, AH transport mode)
- VXLAN (virtual extensible local area network)
- GPRS (general packet radio servic)
Why inspect tunnels ?
For example if we allow a GRE tunnel
We allow GRE from tunnel source to tunnel destination
However everything inside the tunnel is allowed (which we might not want)
If we inspect the tunnel and look at the original IP header and payload and inspect it
Then we can allow/block what we want or enforce QoS
Processing logic
- Tunnel must be allowed
- tunnel inspection rules are evaluated from top down
- packets that match a rule are subject to extra validation (eg RFC checks, unknown protocols)
- Encapsulated traffic becomes subject to security policy evaluation
We can also create tunnel zones
inside zone > tunnel zone
This will make it easier to control the tunnelled traffic
For example TIN and TOUT
Logs
- GUI: Monitor > Logs > Tunnel Inspection, ACC > Tunnel activity
- CLI: show session id
Application override
Simplified app id mechanism which overrides App-ID
You might have a custom app that palo alto doesn't know about so there is no App-ID
L7 inspections are abandoned, just l4
Generally not recommended to use it, we should use App-ID or make customer app-id signature.
When used we should try to limit to the client/server that uses.
Why use it
Improved visibility and reporting
The draw back is we will lose L7 inspections
Our app runs on TCP 57188 but we don't want it detected as unknown TCP
show session all filter application
Policy Based Forward (PBF)
Normal routing forwards packets based on the destination
PAN-OS uses virtual routers
PBF allows us to override those default decision by routing
PBF only works with services (port number) don't use apps because PBF happens before L7 stuff.
PBF can use
- source ip
- destination ip
- ports
- zones
- etc
Why use it ?
Dual link/ISPs
- We may want to send our WIFI traffic out our secondary connection, to take pressure off the primary but also a good indicator that the secondary connection is up and working as users will alert us.
- Security
- Load distribution and testing
- Traffic segregation
- PBF can be combined with path monitoring for failure detection
- If ISP link goes down, we can fail back to the default path
CLI show commands:- show routing route
- show routing fib
- test routing fib-lookup ip 192.168.1.10 virtual-router default
- show pbf
- show session id
- test pbf-test-policy-match
Policy optimizer
A tool that to help control and optimize the security rule set
used for rule migration (ports > apps)
find rules that are never matched and duplicates
Device > setup > Management > Policy rule base settings > policy application usage
In general clone the rule
change the services (ports to apps)
You can move the app rule above the port rule and make sure its matched or just disable the old rule and test. After some period of testing you can delete the disabled rules.
