update palo alto firewall via CLI

When updating from the web gui in a rush its a bit painful

• Do dynamic updates check
• Go to Software
• Unclick Base releases
• wait
• Unclick preferred releases 
• wait
• check for updates
• download the version you need
• install

CLI commands

request system software check (optional, lists all updates without filters)

request system software download version 11.2.7-h16  (download the version we need)

request system software install version 11.2.7-h16 (install the version we need)

palo alto azure VPN issues

Had some issues with palo alto <> azure VPN. The firewall was blocking the VPN traffic due to rule change. Azure gives up after a while and goes into idle mode. Needs to be restarted on azure end

 1 - If Azure VPN starts getting blocked by the firewall after some time Azure gives up and goes into an idle mode, has to be restarted on Azure end for VPN to try again.

2 - The ISAKMP (udp 500) session stays open on the palo even through p1 re-keys. Check session browser for your peer IP on UDP port 500, may need to clear it.

clear session all filter destination x.x.x.x

clear session all filter source x.x.x.x

3 - Related to above if the rule that allows the UDP is set to log at end you won't see the new traffic being initiated, set the rule to log at start.

4 - We saw the Azure IP is showing with a geolocation IP of "EU"  I'm guessing its related to their HA

show location ip x.x.x.x

getting started palo alto

Classic firewalls were L3/4

L3 - ip addresses
L4 - TCP/UDP

Stateful firewall: if its allowed out the reply traffic is allowed.

Next gen features
User based rules
URL filtering (previously done by proxy server)
Firewall learns about new Viruses / malware and blocks them
Deep pack inspection, looking at the application later
Facebook is ok but block facebook messanger
SSL decryption


Getting management access
Seems they take a while to fully boot up after showing you the login: prompt, wait a while before trying default username/password

Two options CLI and Web access
Physical boxes will have a console port and a MGMT port
Default IP is 192.168.1.1
Default username/password: admin/admin
Change your IP, gateway, DNS

Console over writing itself
Had an issue couldn't read output from CLI, these commands fixed it
set cli terminal height 500
set cli terminal width 500


CLI initial config of management port

• Set the default gateway to the core switch
• Plug mgmt port into switch port on same VLAN as inside
• Must have SVI setup on switch
• For example give inside interface 10.0.1.1 and mgmt 10.0.1.2
  

configure
set deviceconfig system type static
set deviceconfig system ip-address 10.0.1.254 netmask 255.255.255.0
set deviceconfig system default-gateway 10.0.1.2
set deviceconfig system dns-setting servers primary 8.8.8.8
commit
exit

Commiting config
You must type the commit command to apply the config.
Current config is what is running
Candidate config is what has been changed but has not been commited yet.

ping host www.google.ie

Web interface 
https://10.0.1.254
Device -> Setup -> Interfaces
Might need to enable ping

Change DNS (DNS in important for the palo to function correctly)
Device -> Setup -> Services

Service route configuration

NTP settings

Device > setup

also not sync'd so conifg on both palo1 and palo2

set the timezone as well.

Upgrading the software
Device -> Software
Check now
You need to upgrade through each major version 7.0 -> 7.1.x -> 8.1.0
Once in 8.1.0 you can go straight to 8.1.5 for example

Tap interfaces (monitor mode)
Setup span ports on the switch and connect to the firewall tap interface
Network -> Interfaces -> Ethernet
ethernet1/1 select interface type as "tap"

Virtual wire interfaces
Bump in the wire
Checks the traffic against security policies
passes the traffic through without needed to create IP on each interface
Select the interface type "Virtual Wire"
Network -> Virtual wires
Add
vWire1
Select the interfaces you want to be part of it
commit

Layer 2 interfaces
You can configure interfaces as L2 interfaces and configure security zones. This is to avoid re-addressing the network. Again set the interface type of Layer2.

Layer3 interfaces
Each interface has an IP address
Network -> Ethernet -> Ethernet1/1
Interface type = Layer3
Assign IP
Assign to security zone
Commit

Zone concepts and policies
Create sec zones like outside, dmz, wifi, inside
Assign interfaces to zones
Lets say we setup eth1/3 as inside zone
We setup several policies
Now we can assign eth1/4 as inside zone and our policies still apply
We don't have to write the same rules for each zone.

Virtual router concepts
There is a default virtual router. This is what we will use in most cases. Its possible to create multiple virtual rotuers.

Config zones, VR and L3 interfaces
Network -> Zones
Add
Inside

Network -> Virtual router
Add
VR1

Network -> Interfaces
ethernet1/1
Interface type = Layer3
Virtual router = VR1
Security zone = Inside

Configure a default route
Data plane (to ISP gateway)
Control plane (MGMT, for NTP, updates, SSH etc)

CLI to see the route table
show routing route

Web interface to see routing table
Network -> Virtual Routers
On your VR click "More Runtime Stats"

CLI to ping from another source
ping source x.x.x.x host 8.8.8.8

Network -> Virtual routers
edit
static routes
add

Configure NAT/PAT

Policies -> NAT
add (in bottom left)
Name it Inside_to_Outsie
source zone = inside
destination zone = outside
You can select IP's etc

Translated packets
Dynamic IP and Port (PAT / global NAT)
Interface Address = the public IP
Interface ethernet1/1
Select  IP
Leave destination as none
Commit

We still need a security policy to allow the traffic

Security policy (ACLs)
There are two default rules

Logging is not turned on by default

Add sec rule
type = intrazone rule

Troubleshooting / verification 
On Policies -> Security
Look at your ACL, can see the hit count, last hit, first hit.
You can clear counters in the bottom right
"Reset Rules Hit Counter"

We can see hit counts for the nat policies

Monitor -> Traffic
Most recent is at the top
You can click on the magnify glass on each entry for more info

Tags
You can setup tags to add a color
eg
outside = red
inside = green
dmz's = yellow

Objects -> Tags
Click add in bottom left
Drop down and select your zone
Select the color
commit



Zone protection
Create zone protection profile
Then apply it to a zone
Network -> Network profiles -> Zone protection
Give a name
Enable flood protection etc
Network -> Zone
Edit the zone, select the zone protection profile
Enable packet buffer protection

Check the documentation some of the features have a performance impact.

Interface management
By default ping is not allowed
Network -> Interface Mgmt
Add
HTTP_and_ping
tick: HTTPS and ping
Click add to add source IP addresses

Network -> Interfaces ->
Edit ethernet1/1
Advanced tab -> Select management profile from dropdown box
Yes
commit

DHCP
Network -> DHCP
Add
select the interface
enabled = on
disaled = off
auto = check if there is already a DHCP server

Tick pick IP when allocating (helps avoid conflicts)
Fill in details gw, dns etc
Can configure DHCP options there

DHCP relay (helper)
Click on the DHCP relay tab
select the interface
tick the box
fill in he IP address of the real DHCP server.

Config management
Create a new tag as a test

3 ways to revert this change
reboot firewall (config not saved)
config -> revert changes
Devices -> Operations -> revert to running config

Making changes but not finished but want to come back
Don't want to commit but want to return to finish these changes and commit later.
Config -> Save Changes

Devices -> Operations -> save named config snapshot

Each time we commit the palo saves a version of the config
Device -> Setup -> Load a config version
Drop now we can see previous versions of config

QoS palo alto

Make QoS policies

Policies > QoS

Assign policies to a profile:

Network > Network Profiles > QoS Profile

Assign a profile to interfaces

Network > QoS

geoblock on palo alto

The FW needs to see the IP before geoblock can be applied 

under monitor > logs > GlobalProtect

( stage eq 'login' ) and ( status eq 'success' )

Also

Network > Gateways, click on the "Remote Users" link on the right

There is also the option to create the NAT for the GP IP only for the geo locations allowed

Have a general security rules with geoblock to/from any deny

Have a security rule to allow access to the GP IP only from the approved countries

Set the countries up in the GP config (portal / gateway)

Config the geoblock on any 2FA you might be using for 2FA as well as another line of defence

Enable the palo EDL blocks and dynamic threats etc, strict IPS

***

GP allow initial connections IP connections 

can geoblock here IE (but be careful about your S2S VPNs, maybe make a rule to all S2S peer IPs) 

outside > OUTSIDE 

D:x.x.x.x (GP public IP)

UDP 500

UDP 4500

UDP 4501

GP allow IE users

outside to outside

D:x.x.x.x (GP public IP)

apps

ike

ipsec-esp

ipsec-espudp

panos-global-protect

ssl

web-browsing

Block everything else

outside to outside

D:x.x.x.x (GP public IP)

any any deny

palo alto mtu

 https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-new-features/new-features-released-in-gp-app/configurable-maximum-transmission-unit-for-globalprotect-connections

You get prompted twice for GlobalProtect with MFA/2FA on palo alto firewall

The usual fix is to put

portal auth > AD 

gateway auth > MFA server

However we found with some OTP/fob code users it wasn't working well

Fix was 

Upgrade GP to preferred release (6.2.3 a time of writing)

Enable the authentication cookie settings on GP

Portal > Agent - Generate cookie for auth override

Choose the same cert you use for the GP 

Gateway > Agent > Client Settings > clock settings > Authenticaiton Override tab

tick Accept cookie for auth override

Choose the same cert you used in portal

Push policy

Watch out for any AD changes may take 15 mins to update on the palo so if you move a user into another group for testing it might not work for 15 minutes

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004MACCA2&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

create custom URL category on palo alto can be used for wildcard URLs

 If you have FQDN then you can just add FQDN object in the rule

If you want to add a wildcard or multiple URLs in a group then you can create a custom URL category

Objects -> Custom objects -> URL categories - > Add

Add your URLs

*.mail.protection.outlook.com/

smtp.office365.com/

Always end with a / ending token

Blurb from the palo:

For domain entries, we recommend you use an ending token. Acceptable tokens are: . / ? & = ; +. If you choose not to use an ending token, you may block or allow more URLs than anticipated. For example, if you want to allow xyz.com and enter the domain as 'xyz.com,' you will allow xyz.com and URLs such as xyz.com.random.com. However, if you enter the domain as 'xyz.com/,' you will only allow xyz.com.

More info here:

https://docs.paloaltonetworks.com/advanced-url-filtering/administration/configuring-url-filtering/url-category-exceptions

CLI

set profiles custom-url-category URL-CC-OSCP-CRL description "Custom URL category for OSCP"

set profiles custom-url-category URL-CC-OSCP-CRL type "URL List"

set profiles custom-url-category URL-CC-OSCP-CRL list [ crl.globalsign.net www.d-trust.net cdp1.public-trust.com crl.cnnic.cn crl.entrust.net crl.globalsign.com crl.globalsign.net crl.identrust.com crl.thawte.com crl3.digicert.com crl4.digicert.com s1.symcb.com www.d-trust.net isrg.trustid.ocsp.identrust.com ocsp.digicert.com ocsp.entrust.net ocsp.globalsign.com ocsp.omniroot.com ocsp.startssl.com ocsp.thawte.com ocsp2.globalsign.com ocspcnnicroot.cnnic.cn root-c3-ca2-2009.ocsp.d-trust.net root-c3-ca2-ev-2009.ocsp.d-trust.net s2.symcb.com aia.startssl.com apps.identrust.com cacert.omniroot.com ]

install wildcard cert on palo alto firewall

Global protect portal and gateway should be setup

Get customer to get DNS record created eg globalprotect.domain.com

Point the record at the global portect portal IP (Network -> Global Protect -> Portals)

Download the wildcard cert and root/chain cert from the cert vendor (.crt format). The windows .p7b format is no good. The chain bundle cert usually publicly available. The wildcard will need to be downloaded via a login may need to get it from the customer.

Install wildcard cert on palo alto firewall

Global protect portal and gateway should be setup

Get customer to get DNS record created eg globalprotect.domain.com

Point the record at the global portect portal IP (Network -> Global Protect -> Portals)

Download the wildcard cert and root/chain cert from the cert vendor (.crt format). The windows .p7b format is no good. The chain bundle cert usually publicly available. The wildcard will need to be downloaded via a login may need to get it from the customer. Example vendor chain location:

https://certs.godaddy.com/repository

Import vendor root/chain cert bundle

Device -> certificate management -> certificates 

Click import 

Give name eg "vendor-ca-root-chain-bundle"

Select the bundle file "bundle-g2.crt"

Leave everything else and click ok

Import wildcard cert

This can be imported in a few methods (.crt) (.pfx) if its PFX you will need to include the password

Certs should look like this

 

Create SSL/TLS profile

Device -> Certificate Management -> SSL/TLS Service Profile

Name "SSL-TLS-PROFILE"

Min version: TLSv1.2

Max version: Max

Attach SSL/TLS profile to global protect portal and GW

Network -> GlobalProtect -> Portals 

Click the GP_Portal

Authentication tab 

Under server authenticaiton / SSL/TLS service profile

Select your "SSL-TLS-PROFILE" from the drop down

Configure the URL used for portal/gateway in the portal

Network -> GlobalProtect -> Portals

Click the GP_Portal

Agent 

Add the CA root and chain cert (optional to tick install in root cert store)

 

Now click on GP_Agent_Config -> External

You will need a DNS -> pub IP record setup with the external DNS vendor

Fill in the DNS name for the Gateway

 

Add the SSL-TLS profile to the gateway as well

Network -> GlobalProtect -> Gateways

Click the GP_Gateway

Authentication tab

Under server authenticaiton / SSL/TLS service profile

Select your "SSL-TLS-PROFILE" from the drop down

Change IP to URL

Go Portal - GP settings - Agent - Agent config - External

Change external gateway IP to URL

Testing

Do not forget to commit your changes

You may need to restart the GP client

Test web browse to https://globalprotect.domain.com

Test connecting the GP client to globalprotect.domain.com

issue with palo alto expedition tool

 Palo Migrations tool kept failing without an explanation

The tool seems to have an issue with psks on the VPNs

When you load the config from the migration you need to change / update the psks and it will load correctly

Palo alto BPA

Log into your palo alto firewall

On Device -> Support 

In the Tech Support File section 

Click generate Tech support file (takes a while)

Then download the tech support file

Log into support web site:

https://support.paloaltonetworks.com/

Will have to login with google authenticator 

Login with your account.

Select the customer account in the top left drop down

On the left hand side go to tools -> Best Practice Assessment

Click on "Generate New BPA" in the top right

Select the downloaded tech support file

Select architecture classfications

Untrust = Internet etc

Don't enable Inline cloud analysis under anti spyware section of BPA, drops traffic but doesn't show in the logs.

test policy on palo alto similar to packet tracer

 I haven't had much luck with this, it doesn't seem to work as well as packet tracer. It's often returning that the traffic is blocked when in fact it is allowed.

Anyway you can give it a go, its down the bottom in the GUI "Test policy match"

On CLI:

test security-policy-match source 192.168.0.1 destination 8.8.8.8 destination-port 53 protocol 17

test security-policy-match source 192.168.0.1 destination 8.8.8.8 destination-port 443 protocol 6

Protocol 17 = udp

Protocol 6 = tcp

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/test-the-configuration/test-policy-matches

NAT on palo alto firewall

 I find switching from ASA to palo alto NAT confusing because they work in a different way and I've worked on ASA for so long.

nat rule (to nat traffic)

outside -> outside

Destination address is customer public IP: 100.200.200.114

Destination translations address is inside IP of the server: 192.168.0.1

policy rule (to allow traffic)

outside -> inside

Source IP is outside source public 8.8.8.8

inside destination IP is the public IP: 100.200.200.114

The main thing there is a public IP NAT is outside to outside on palo. On ASA its outside to inside for a public IP NAT.

• Source zone: outside
• Destination zone: outside
• Destination interface: eth1/1 (outside)
• Source add: any
• Destination address: 100.100.100.50 (public IP of server)
• Service: port 443
• Source translation: "none"
• Destination Translation:
• destination-translation (translation type "static IP")
• address: 192.168.100.50 (inside IP)
• port: 443

bulk edit rules on palo alto firewall

making a note here about bulk changing rules on palo alto firewalls. Apparently you can use expedition tool, import config, make changes, export config. There is another thing called cpan https://github.com/PaloAltoNetworks/pan-os-php which is similar but you can do it on CLI. I didn't have the time or the energry to try install and get it working but something I might look into in the future.

show all NAT's for a public IP on palo alto firewall CLI

 show session all filter nat destination | match 100.200.200.10

creating a script to import multiple IP's into palo alto firewall

Get your list of IP's into sublime text or notepad++ so its easy to work with
You can use excel to generate the objectname[x]

Create the address objects
set address [address-name] ip-netmask [ip-address]

eg

set address malware-ip1 ip-netmask x.x.x.x
set address malware-ip2 ip-netmask y.y.y.y

Assign the objects to a group

set address-group [address-group-name] static [address-name]

eg

set address-group malware-ips static malware-ip1
set address-group malware-ips static malware-ip2

Once I have my script
Connect to the CLI of the palo and paste it in
I have found it only allows you to paste 80 lines or so
Sometimes I need to split up my pastes but it works for me haven't had time to look into it

Once you've got it all in there don't for get to commit

Now you can go back to the web interface / GUI and create a rule with the new address group which should contain all your IP's