Palo alto PCNSA notes

Palo alto firewall

Palo alto is next gen firewall with user-id and app-id. Dynamic lists/feeds (EDL) for blocking malicious traffic and allowing trusted traffic like azure and CDNs etc.

It can do its inspections on north/south traffic and east/west traffic.

It has IPS, URL, wildfire (unknown threats).

DNS sinkhole (DNS protection)

Advanced logging with cortex datalake (take in multiple log sources and apply machine learning)

Platforms

• Virtual machines for public and private cloud (you control the VM)
• Prisma access (hosted cloud based firewall as a  service)
• Physical devices (physical boxes to install on site)

https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations

SP3

Single pass simultaneous traffic inspection, classification and enforcement in one pass

Traffic 

Control plane

• config 
• logging 
• reporting 

Data plane

• Signature matching 
• security and network processing 

Management options

• Web interface HTTPS over the network or MGMT port
• CLI via SSH over the network or via console cable
• Panorama - centralized platform for managing multiple firewalls. Good for MSP. 6+ devices.
• API - XML REST based API. Good for automation and network programming

The management GUI on box help

There is an onbox documentation, usually in the top right

ACC - Application Command Centre

Analytical tool to provide actionable intelligence about network activity. Shows trends etc.

Monitor tab

• Live logs
• Reports

Policies 

• Firewall / NAT rules etc

Objects

• Setup objects for use in policies

Network

• data plane interfaces and zones
• VPN related items

Device

• General settings
• Management interface
• User accounts
• Licenses
• Config backup

Management port is part of the control plane

Default 192.168.1.1/24

HTTPS

default user: admin/admin

We can disable it if needed and use network interface

By default dataplane ports won't accept mgmt packets

Service routes

For all items we need to reach out of the firewall for eg radius / log forwarding etc. 

By default it will use the mgmt port

Device > Setup > Services > Service Router Configuration > Customize 

Lots of these settings are not sync'd like NTP so have to config on both palo1 and palo2

Don't forget to set timezone 

CLI modes

• Operational - basic network commands: ping traceroute, show, debug
• Configuration - configure command, now you can make changes
• Similar to cisco in that regard

CLI enhancements

• User find to figure out the command syntax
• use ? to get help
• User tab to autocomplete
• Use | pipe with "match" or "except" for output filtering

ping "tab"

We will sett options with symbols

+ count - plus means it needs a value

* host - * means its required

> - means you will have more options after

ping host 1.1.1.1

tail - useful for log messages

set is how we do some config 

show is how we show the config

Find all the commands related to the network

find command keyword network

W can see ethernet is under interface under network. To change ethernet1/1 from cli we need to use:

set network interface ethernet1/1

CLI is good for checking and debugging but most config will be done via CLI now

Firewall maintenance

Config files

Running config (running-config.xml)

sits in the dataplane and this one controls the firewall behaviour

When the firewall reboots this config is loaded when it boots up 

Candidate configuration (snapshot.xml)

Separate file/space in memory to store temporary configuration in the control plane

Its config we have configured but have not deployed yet. 

When we do a commit its merged into running config.

Saving the candidate config doesn't commit the changes

Candidate config is the running config + the new changes

Commit command merges the changes from candidate config into running config

New updated running config has the new changes

We can revert to last saved conf

Replaces current candidate config with a saved candidate config file

We can revert to running config (probably will use this one most)

Get rid of un-commited changes

Load 

over writes with a file saved earlier (usually from a backup, used when restoring) 

Save

Can save a named config snapshot.

Export

Export a named config (backup)

Dynamic updates

• Make sure these are enabled and auto downloading / installing 
• Antivirtus / Wildfire 
• Apps and threats 
• Global protect HIP
• PAN-DB URL filtering (may use umbrella instead)

Palo alto policy types

• Security (firewall rules etc)
• NAT (global NAT, NoNats, public NATs etc)
• QoS (voice QoS)
• Policy based forward (PBR)
• Decryption (SSL)
• Authentication ( radius / SAML etc)
• DoS protection 
• Tunnel Inspection
• SD-WAN

Palo alto works like ASA

works from top to bottom

when rule is match traffic is dispatched 

it doesn't check any futther rules

Security policies

• The primary traffic control tool
• Block rules at top like block lists, implicit deny at the bottom.
• Add the most specific rules at the top

IntERzone vs IntRAzone

• IntERzone (lan to dmz)
• IntRAzone (same zone)
• Universal (interzone + intrazone combined)

Application/Service 

• select (pick which ports)
• any (allow HTTP on any port for example)
• application-default (web-browsing only allowed on default ports 80/443 but not 8881)

Generally we don't want to allow apps on lots of ports but some custom applications run HTTP etc on non standard ports.

• applicaiton-default - use this where we can as first preference
• select - in edge cases we can config the specific ports. Second choice.
• any - only for testing or we can't get it working any other way. Last resort.

Default rules can be changed by using the override button.

Policy objects / groups

Its efficient to group items into groups so later the groups can be updated but your firewall rules can remain unchanged.

Security profiles

ping command source from inside to host

ping source 192.168.10.100 host 192.168.10.50

however if the clients try to ping the firewall it will fail by default. We would need to create a management profile, allow ping and apply it to that interface.

ACLs can be found under

Policies > Security 

We can see applications ping and icmp

icmp is for the full protocol (except for ping)

ping is the ping app which is under icmp protocol

How to block web comms to a specific IP

NAT

• Allows network devices to change source/destination of packets.
• Main function for IPv4 depletion but has other uses.
• In most orgs its used to hide all clients behind a single IP for internet access (NAT overload)
• The other main use is to give servers a static public IP
• NoNAT's are used for S2S VPNs

SNAT - source NAT

DNAT - destination

Some devices allow changing source and destination at the same time

Static NAT is to map one IP to one IP

Dynamic is IP that gets mapped can come from pool of IP's. Dynamic includes port translations

On palo alto we have a NAT policy

• A NAT rule has 3 main sections:
• General
• Original packet
• Translated packet

NAT type: IPv6 / IPv6

Original packet is how we select the original packet

Translated packet is what we want to change it to

Rules can refer to address objects instead of IPs

It's recommended to use objects in case the IP is updated later.

• NAT Rule processing is top down
• Applies regardless of NAT type
• Most specific rules at top
• More general NAT's at the bottom
• No NAT rule can go at the top (exemptions)

IP addresses should always refer to the original IP's, pre-NAT

Use the original IP in the firewall rules as well.

Remember NAT does the translation but it doesn't allow or deny anything. That is the job of the security policy.

test routing fib-lookup virtual-router default ip 192.168.57.31

Will give you the interface it will go out.

show routeing route 

Shows all routes

Working with NAT

Policies > NAT

In some cases we might need to adjust routes

For example when you need to NAT to an external IP block 

In the case there is one public IP range configured on the outside of the firewall

A second block/pool has been added on later. In this case the firewall doesn't know about it.

Like an extra IP block

You may need to adjust routing so traffic knows how to get back to the firewall.

Verify and TS

Device > troubleshooting > NAT policy match

Rule usage, check hit  counts / last hit / fist hit

CLI

• show session all
• show running ippool
• show system state | match nat

Goal is to enable dynamic NAT with a pool for any inside network

This will be source NAT (SNAT)

As the traffic leaves we will change the source to something else

First create your object with your public IP pool.

Name: DPOOL

IP netmask: 192.0.2.0/24

Policies > NAT

Add rule

Give a name

SRC: IN

DST: OUT

Go to translated packet

Change source to dynamic IP

select: DPOOL

NAT policy doesn't automatically allow the traffic. You will need a security policy rule as well.

You may need to have a route setup to route back.

Goal expose a DMZ device to the internet 

This will be destination translation from outside to outside

Palo NAT works on addresses and zones from the original packet, that is why we do outside > outside and not outside > dmz.

NAME: STATIC

SEC: OUT

DEST: OUT

DEST ADDR: 102.0.2.230

Translated packet

Source translation: none

Destination translation type: static IP

Translated address: 192.168.57.31

We don't need bi directional here because the firewall will allow the return traffic.

Again you will need security policy to allow the traffic

In the security policy it applies after translation. So we will need OUTSIDE > DMZ, even though the address belongs to outside.  

NAT policy: original packet (outside to outside)

Security policy: after translation (outside to DMZ)

Logging and monitoring

logs are timestamped events, often including useful information src/dst IP etc. 

Important log types but there are more

• Traffic - src/dst IP, ports, app, nat
• Threat - details on detected threats
• Config/Audit - what changes admin made
• System - the PAN os system
• User-ID - details about user ID
• Global protect - the dial in VPN logs

Log settings

• Session start - log at the first packet (useful for UDP and sessions that never fully setup/close)
• Session end - log when the tcp connection has closed
• Log forwarding - send logs to external syslog server/SIEM etc. The firewall can only store so much.
• Logs can be filtered
• Log profile defines the external log server
• Log forwarding is where we define what logs we will send

Enhanced logging

We can collect additional data for cortex XDR. You need data lake subscription 

Config

Device > server profiles > syslog

Add profile

SYSLOG-PROF

fill in IP of syslog server 192.168.100.50

Device > Setup > Services

Make sure you use the right interface for syslog, often picking inside/lan interface

Objects > Log Forwarding

LOG-FWD

pick traffic and select SYSLOG-PROF

Log settings 

under config logs do the same

In our rules set the logging settings as needed (session start vs session end)

If we need to override the default rule, log at session end

Set log forwarding

Policies

App-ID

We need app ID for modern threats

Different protocols can be listening on different ports 443/80/22

When the palo see's a connection on port 80 for example it will check that its TCP and that its HTTP protocol. Now it knows its actually HTTP traffic running on its standard port so can be allowed/blocked.

If the connection shows TCP but SSH protocol then the connection could be blocked as it won't match the application rule.

Similarly if we see TCP and HTTP protocol but the port is 8080 the palo will also block if its set to look for application default ports. This can be changed in the firewall rule settings

Advanced policies

QoS - a set of tech that we can enable to control traffic bandwidth/latency/jitter etc.

Palo can do classification on packets based on the user and app

Bandwidth mgmt - limit/guarantee bandwidth for certain apps/flows

Priority queuing - voice traffic gets processed first

example classification

• voice/teams
• business critical apps
• everything else

Default profile is just for prioritization

Policies > QoS

Class 4 is the default

We can use DSCP and/or ToS marking that may have been done by other netwok devices and honor them or change them as you need

Use post NAT address in QoS (like in security access policy)

QoS is processed top down and exits on rule match

QoS is outbound/Egress feature. Affects outbound interface only 

To limit downloads from the internet, apply QoS in inside interface (egress to inside/LAN)

To limit uploads , apply QoS to outside interface (egress to internet)

Turn QoS on the interface

Physical vs clear text vs tunnelled interface 

Egress max is the max speed of the interface.

If a class has egress max 0, the value of egrees max will be used

When we guarantee bandwidth its only kicking in, in the event of congestion

Classes with no guarentee'd bandwidth will show a guarantee of 0.001 mbps

Steps

Create QoS policy

Create QoS profiles

Don't forget to commit

After applying check the statistics 

Decryption

Decryptions allows the firewall to look inside encrypted connections like HTTPS connections

We may detect malware coming across the encrypted flow and we can block

If we don't decrypt we are not able to detect it in transit and would hope the endpoint AV will catch it

Some traffic can't / shouldn't be decrypted

SSL/TLS decryption (man in the middle)

SSL forward proxy (outbound traffic)

Certs needed:

• Forward trust 
• Forward untrust

Client < > (SSL decrypt) FW (SSL decrypt) < > internet > Server

• When client starts a connection, the firewall intercepts the connection setup
• The firewall impersonates the server. 
• The firewall does the same to the server, impersonates the client
• The client thinks its talking to the server but its talking to the firewall
• The server thinks its talking to the client but its talking to the firewall
• The firewall joins both ends but is able to look inside the connection

SSL Inbound inspection

Applies to inbound traffic, usually to your public servers

Internet > HTTPS > FW > DMZ > Web server

In this method we install the certs from our servers on the firewall.

SSH decryption

We don't need certs

Useful to find people using SSH port forwarding x11 or TCP connections

Decryption mirror

We can copy decrypted traffic to a destination on an interface. The traffic gets sent 1 way out to be logg or inspected by another system

Decryption broke

Firewall still decrypts but only sends the allowed traffic to other devices for additional inspection

FW > C-TXT > SC1 > SC2 > remaining allowed traffic goes back to the firewall 

Decryption exclusions

Some apps can't be decrypted. Some compliance / regulation means we can't decrypt banking and health data as its private.

Decryption certs

• Forward trust cert - needs to be trusted by enpoints
• Forward untrust cert - should not be trusted because we want to represent untrusted destinations
• SSL inbound certs will - install the certs/private key from your pubic servers on the firewall

Decryption profile

We can set extra options on how to handle sites that have expired or old ciphers etc

Define sites to decrypt by zone, user, but you will probably use URL category the most

In new infra make a NoDecrypt URL category and choose to decrypt everything else.

For existing infra you will want to move gradually, start with some non critical sites or test users

Device > certificate management > SSL decryption exclusion

Disable decryption temporarily via CLI

• set system setting ssl-decrypt skip-ssl-decrypt yes

The command applies immediately, does not need commit. You can test your site/rule ssldecrypt in/out of your issue

Turn it back on

set system setting ssl-decrypt skip-ssl-decrypt no

Checking logs in the GUI:

• Monitor > logs > traffic

Checking logs on the CLI:

• show session all filter ssl-decrypt yes
• show counter global | match proxy

If the session is decrypted we should see a * in the flag field. If its blank we did not do decryption

ACTIVE FLOW * 192.168.100.50

SSH decryption

Create a decryption policy with the action set to SSH proxy

To see if SSH is tunneling traffic we need to decrypt

Normal SSH traffic is SSH, SCP, SFTP

In you security rule allow the the app ssh but block ssh-tunnel

Example rule order

• NoDecrypt / exclusion list
• HTTPS decrypt
• SSH decrypt

Tunnel inspection 

Looking at content of cleartext pass through tunnels

• GRE (generic Routing Encapsulation)
• IPsec (ESP with null encryption, AH transport mode)
• VXLAN (virtual extensible local area network)
• GPRS (general packet radio servic)

Why inspect tunnels ?

For example if we allow a GRE tunnel

We allow GRE from tunnel source to tunnel destination

However everything inside the tunnel is allowed (which we might not want)

If we inspect the tunnel and look at the original IP header and payload and inspect it

Then we can allow/block what we want or enforce QoS

Processing logic

• Tunnel must be allowed
• tunnel inspection rules are evaluated from top down
• packets that match a rule are subject to extra validation (eg RFC checks, unknown protocols)
• Encapsulated traffic becomes subject to security policy evaluation  

We can also create tunnel zones

inside zone > tunnel zone

This will make it easier to control the tunnelled traffic

For example TIN and TOUT

Logs

• GUI: Monitor > Logs > Tunnel Inspection, ACC > Tunnel activity 
• CLI: show session id

Application override

Simplified app id mechanism which overrides App-ID

You might have a custom app that palo alto doesn't know about so there is no App-ID

L7 inspections are abandoned, just l4

Generally not recommended to use it, we should use App-ID or make customer app-id signature.

When used we should try to limit to the client/server that uses.

Why use it

Improved visibility and reporting

The draw back is we will lose L7 inspections

Our app runs on TCP 57188 but we don't want it detected as unknown TCP

show session all filter application

Policy Based Forward (PBF)

Normal routing forwards packets based on the destination

PAN-OS uses virtual routers

PBF allows us to override those default decision by routing

PBF only works with services (port number) don't use apps because PBF happens before L7 stuff. 

PBF can use

• source ip
• destination ip
• ports
• zones
• etc

Why use it ?

Dual link/ISPs

• We may want to send our WIFI traffic out our secondary connection, to take pressure off the primary but also a good indicator that the secondary connection is up and working as users will alert us.
• Security
• Load distribution and testing
• Traffic segregation
• PBF can be combined with path monitoring for failure detection
• If ISP link goes down, we can fail back to the default path 

CLI show commands:

• show routing route
• show routing fib
• test routing fib-lookup ip 192.168.1.10 virtual-router default
• show pbf
• show session id
• test pbf-test-policy-match

Policy optimizer

A tool that to help control and optimize the security rule set

used for rule migration (ports > apps)

find rules that are never matched and duplicates

Device > setup > Management > Policy rule base settings > policy application usage

In general clone the rule

change the services (ports to apps)

You can move the app rule above the port rule and make sure its matched or just disable the old rule and test. After some period of testing you can delete the disabled rules.

App-ID

Objects > Applications

Palo has built in App-ID's in its database

You can customize some info, but some info is fixed

You can also make a custom app-id for bespoke apps

App properties

Category, subcategory

Risk 

Technology

Tag (add your own tag)

Characters 

Working with applications 

App rules > port based rules (because anything can be tunnelled over port 80/443, we need to look deeper)

We should make app rules on top

port rules below

Review the hitcounts and detected applications, work towards removing the port based rules.

If we do have to use a port based rule we can lock it to source/destination 

Applicaiton-default

reduces administrative overhead

port-mappings

We can look in objects > applications >facebook and see what ports it uses by default.

We can also look on https://applipedia.paloaltonetworks.com/

Application dependencies

Many applications will rely on another application

Implicit dependencies - will be enabled automatically 

Explicit dependencies - requites to be added manually

eg

Facebook requires "http" and "ssl"

Check objects > applications

Check an app

Check the "implicitly uses"   (implicit)

Check the "depends on"         (explicit)

When adding an app to the rule we should see a list of depends on applications. You can quickly add these to the existing rule.

We can make application groups

objects > application groups 

eg 

make a app group call social media, then add facebook, instragram, twitter 

Now we just need to allow our users access to this group 

Similar to applications group is application filter

We say what characteristics/properties make an app part of the filter

eg business-filter

go to category and select business relevance and risk level 1 (most secure)

This may allow apps in the future that you don't intend but also can save you time.

Custom applications

Created for better visibility and granular control

Lets say you have a custom application in your org

It's showing up as unknown-tcp

So we may need to build a custom application

We should have detailed information on how the app works

You may need to do a wireshark on the traffic

User-ID

Classic firewall rules were based on IP's and ports. From a world where everyone was in the office etc.

We would give important clients and servers static IP's and create firewall rules based on those.

Today we try to work off role based access control (RBAC). For example Bob is a member of marketing and everyone in the market team should have access to facebook. We also have users working on WIFI and in remote locations from home etc. User IP's are often given by DHCP on top of that so that makes the old IP based policies no longer sufficient.

Most application firewalls will also be user aware. This is done by connecting the firewall to active directory and the firewall keeps a user to IP mapping. This process is known as user-id. We can now make firewall rules based on the AD username or group. On top of that we will get more information on users in our logging like how much bandwidth they are using etc.

How user ID works ?

The user info is not part of the network traffic. We just see a connection from an IP to www.facebook.com. It can work by several methods.

Group mappings

Firewall collects group mapping info for simplified administration. Eg connect to LDAP server. You will need an AD account to connect.

Global protect user-id

When users log in via the global protect client they type in the username and password. The firewall can record who the remote user is at that point. This is why you will often see user-id is working for remote clients but LAN clients it hasn't been enabled yet.

Windows agent

Software installed on the DC's. 

Saves CPU on the firewall MGMT plane.

Needs some bandwidth has agent must send data to the firewall

Software has to be installed/updated on the DC

Integrated agent (or agentless)

built into the firewall 

Reduces bandwidth usage 

Server monitoring

analysis of the event logs

Syslog

analysis of syslog login/logout

Port mapping

For multi-user system, such as terminal services or citrix

XFF headers

X forwarded for header will be there if a proxy server is in use

Auth with Captive portal

All the other methods are passive, the user doesn't have to do anything.

Captive portal is the only active method.

This is where the user gets a pop up to enter their username and password

Works with Kerberos SSO, NTLM, Client cert. More than one method can be used.

Captive portal modes

transparent - good for L2 or Vwire deployments

redirect  - Firewall does 302 redirect to original request, better user experience 

General overview

• Enable User-ID in the right zone (GP and LAN etc)
• Map IP address to users (with one of the methods, usually passive server monitoring)
• Create user ID rules (create your firewall rules based on app and user roles)

Deploying authentication

Server profile

• Device > Server Profiles > LDAP
• Add our server IP and port 389
• Type will be active directory
• Base DN, DC=domain,DC=int
• Bind DN admin@domina.int
• password: secret-strong-password-here

Group mapping

• Device > User ID > Group Mapping settings
• Add mapping
• Choose the server profiles
• Choose the group from AD
• Instead of fetching all AD groups we can choose
• Most deployments we will want to bring in all groups
• This is also a good test to see if the server profile is working

Auth profile

Device > Authentication profile

Add

type LDAP

Server profiles (select profile created above

User Domain ( domain ) 

*** if you leave this off the users may not match

*** We want domain\user, not just user

CLI commands for checking

show user group list

show user group name

show user ip-user-mapping

show user ip-user-mapping all

Clearing cache in case of troubleshooting / after fixing a broken AD connection

clear user-cache all

clear user-cache-mp all

clear uid-cache all

delete user-group-cache 

Enable user ID on the zone

Network > Zones

Click on Inside zone for example

Tick the enable user ID check box

Service routes

Devices > Setup > Services

Check the settings on LDAP and UID agent are correct

In some cases you will want the LDAP/UID to come from the LAN interface 

For captive portal make below

Network > Network profiles > Interface MGMT > Add interface mgmt profile

enable response pages

Enable user ID

This can be used later for captive portal

Portal certificate

• Device > Certificate mgmt > Certificates > Device Certificates
• For self signed make sure to check "certificate authority"
• Bind the server to a SSL/TLS profiles
• Device > Certificate management > SSL/TLS service profiles

When generating the cert

PA-CERT

common name: x.x.x.x (IP of the interface on the firewall eg LAN IP)

check certificate authority box

This cert will need to be trusted by all clients, you can deploy it to GP clients via the firewall

But best to deploy out via GPO or Intune

Device > User identification

Tick enable captive portal

Choose your SSL/TLS profile (one we made above)

Pick redirect mode

Fill in FW inside IP for the portal address

Auth policy for captive portal

Policies > Authentication

Add auth policy rule

Name your rule eg auth-trigger-http

select src and dst (eg inside > outside)

user is unknown 

service is service-http

authentication enforcement: default-web-form 

Troubleshooting

• Use CLI commands to troubleshoot
• Clear cache and retry connections, is the mapping working ?
• Ensure you can reach your AD servers from the right interface
• Ensure your AD user account is valid, has rights and correct password
• Ensure you mappings are correct domain\user vs user