PAN-OS · MANAGER

PAN-OS-style: a template, a device group and your first push

F1 is connected and empty. Build its network in a template and its policy in a device group. There are two steps now: commit saves on the manager, and push sends what is committed to the firewalls. Until you push, F1 knows nothing about it.

Palo Alto PAN-OS-style track · Palo Alto PAN-OS-style, Cisco router, Buddy Policy Manager · 5 objectives

Open in simulator More Palo Alto PAN-OS-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Template NET: ethernet1/1 at 192.168.1.1/24 in zone trust, ethernet1/2 at 203.0.113.1/24 in zone untrust, both in the virtual router, with a default route to 203.0.113.2. Put SN-F1 in it.
Device group SITE: a NAT rule HIDE from trust to untrust behind ethernet1/2, and a pre-rule OUT from trust to untrust, application any, service any, allow. Put SN-F1 in it.
Commit on the manager. PC1 still can’t reach anything: nothing has been pushed.
Push the template, then the device group: commit-all template name NET, and commit-all shared-policy device-group SITE. F1’s show running security-policy shows OUT, marked as from the group.
PC1 reaches 192.0.2.1.

Start this lab

Before you start

Push the template first: a rule that names a zone can’t be pushed to a firewall with no such zone, and the push says so and changes nothing. show devices all shows each part as In sync, Out of sync or Never pushed. commit-all is the real push command. Attaching a firewall straight to a template, show devices all in this layout and show pushes are RouteBuddy’s short teaching forms: a real Panorama attaches firewalls to a template stack.

Concept

A template holds the network, a device group holds the policy

A manager runs many firewalls from one place. Templates hold network settings, device groups hold rules and objects, and shared holds what every group gets. There are two steps: commit saves on the manager, and push sends what is committed to the firewalls. A firewall that refuses a push keeps what it had.

Concept

The candidate waits for commit

A PAN-OS-style firewall keeps two configurations. Your changes go into the candidate, and the firewall keeps running the old one until you commit. If the candidate has an error, the commit fails and nothing changes.