PAN-OS · FOUNDATIONS

PAN-OS-style: zones, a rule and your first commit

A PAN-OS-style firewall keeps two configurations. Your changes go into the candidate, and the firewall keeps running the old one until you commit. Traffic moves between zones, so an interface does nothing until it has an address, a zone and a virtual router. Select FW1 and press Open Web Interface, or type: the console takes the same lines.

Palo Alto PAN-OS-style track · Palo Alto PAN-OS-style, Cisco router · 5 objectives

Open in simulator More Palo Alto PAN-OS-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Interfaces: ethernet1/1 at 192.168.1.1/24 in zone trust, ethernet1/2 at 203.0.113.1/24 in zone untrust, both in virtual router default.
A default route: destination 0.0.0.0/0 to next hop 203.0.113.2.
A NAT rule HIDE: from trust to untrust, hiding traffic behind ethernet1/2. A security rule OUT: from trust to untrust, application any, service any, action allow.
Before you commit, try the ping from PC1: it fails, because all this is still only the candidate. show config diff lists what is waiting. Commit.
PC1 reaches 198.51.100.1.

Start this lab

Before you start

After your rules come two defaults: traffic within a zone is allowed, and traffic between zones is denied. So without rule OUT, a commit alone would not help. In the web interface, the Commit button shows the difference first.

Concept

The candidate waits for commit

A PAN-OS-style firewall keeps two configurations. Your changes go into the candidate, and the firewall keeps running the old one until you commit. If the candidate has an error, the commit fails and nothing changes.

Concept

Rules go from zone to zone, and the defaults matter

An interface passes traffic only with an address, a zone and a virtual router. Security rules go from zone to zone and are read from the top. After your rules, two defaults apply: traffic within a zone is allowed, and traffic between zones is denied.