PAN-OS · CAPSTONE

PAN-OS-style capstone: HQ pair, DMZ, branch tunnel and remote users

Build a company’s whole edge on three empty firewalls. HQ is an active/passive pair (HQ1, HQ2) with an inside and a DMZ with the web server SRV. The branch firewall BR joins its LAN to HQ over a route-based tunnel. alice works from home on LAP1 with GlobalProtect. R1 is the internet, with 198.18.0.1 behind it.

Palo Alto PAN-OS-style track · Palo Alto PAN-OS-style, Cisco router, Cisco switches · 6 objectives

Open in simulator More Palo Alto PAN-OS-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

HQ1: inside 192.168.1.1, outside 203.0.113.1, dmz 172.16.1.1, each /24, a default route to 203.0.113.254, HIDE for the inside, and rule OUT. Publish SRV as 203.0.113.10: rule PUB-WEB from untrust to dmz naming the public address, with a blocking vulnerability profile.
A tunnel between HQ1 and BR, key HQBRKEY, in zone vpn with VPN-OUT and VPN-IN. BR: inside 192.168.2.1, outside 198.51.100.1, default route to 198.51.100.254, HIDE and OUT, and the mirror of the tunnel. PC1 reaches PCB.
GlobalProtect on HQ1: pool 10.99.0.10 to .50, split 192.168.1.0/24, tunnel.2 in zone vpn-users, user alice (Lab123), and rule GP-IN. On LAP1: vpn connect 203.0.113.1 user alice password Lab123, then ping PC1.
High availability: HQ1 priority 100 and HQ2 priority 200 over ethernet1/4 (10.255.255.1 and .2, /30). HQ2 gets the HA lines only.
PC1 reaches 198.18.0.1. From LAP1: traffic tcp 203.0.113.10 80 payload "GET /index.html" arrives, and traffic tcp 203.0.113.10 80 payload "GET /../../etc/passwd" is blocked.
It all keeps working without HQ1: the check takes HQ1’s links down in a copy of the lab.

Start this lab

Before you start

Build HQ1 fully, then HQ2 gets only the HA lines. The tunnel and alice’s session follow the active unit, because the addresses move with the role.

Concept

A tunnel is an interface, so routes and zones decide

On some firewalls a crypto access list picks what goes in a tunnel. Here a tunnel is an interface. A route puts traffic into it, and because the interface is in a zone, a security rule must allow that zone. A NAT rule to untrust doesn’t touch it, because the traffic is going to the tunnel’s zone.

Concept

One active unit, and the addresses move with the role

Two units watch each other over an HA1 link. The active one answers on the interface addresses, and the passive one copies its configuration and keeps its links quiet. If the active unit fails or is suspended, the passive one takes over with the same addresses, so hosts keep their gateway. Each unit keeps its own HA settings, management address and host name.

Concept

A security rule: the address before NAT, the zone after NAT

To publish a server, the NAT rule goes from untrust to untrust, because before NAT the public address is out there. The security rule goes from untrust to the server’s real zone, and still names the public address. Its two halves come from different moments in the packet’s life.

Concept

Profiles read what an allow rule lets through

A rule allowing web browsing allows an attack inside web browsing, and any site. A security profile reads the traffic of an allow rule. A vulnerability profile looks for known attacks, and a URL filtering profile looks at where a request is going. A profile does nothing until a rule uses it.