Palo Alto Networks

Firewall 8.1 Essentials:

Configuration and Management

Lab Guide
PAN-OS® 8.1
EDU-210
Courseware Version A

Palo Alto Networks® Technical Education

Palo Alto Networks, Inc.
https://www.paloaltonetworks.com
© 2007-2018, Palo Alto Networks, Inc.
Palo Alto Networks, WildFire, and PAN-OS are registered trademarks of Palo Alto Networks,
Inc. All other marks mentioned herein may be trademarks of their respective companies.

© 2018 Palo Alto Networks, Inc. Page 2

Table of Contents
Table of Contents ............................................................................................................................ 3
Typographical Conventions .......................................................................................................... 10
How to Use This Lab Guide ......................................................................................................... 11
1. Lab: Initial Configuration ......................................................................................................... 12
Lab Objectives ...........................................................................................................................12
1.0 Connect to Your Student Firewall .......................................................................................12
1.1 Apply a Baseline Configuration to the Firewall ..................................................................12
1.2 Add an Admin Role Profile .................................................................................................13
1.3 Add an Administrator Account ............................................................................................13
1.4 Test the policy-admin User ..................................................................................................14
1.5 Take a Commit Lock and Test the Lock ..............................................................................15
1.6 Verify the Update and DNS Servers ....................................................................................17
1.7 Schedule Dynamic Updates .................................................................................................17
2. Lab: Interface Configuration..................................................................................................... 19
Lab Objectives ...........................................................................................................................19
2.0 Load Lab Configuration .......................................................................................................19
2.1 Create New Security Zones ..................................................................................................20
2.2 Create Interface Management Profiles .................................................................................20
2.3 Configure Ethernet Interfaces ..............................................................................................21
2.4 Create a Virtual Wire ...........................................................................................................24
2.5 Create a Virtual Router ........................................................................................................24
2.6 Test Connectivity .................................................................................................................25
2.7 Modify Outside Interface Configuration..............................................................................26
3. Lab: Security and NAT Policies ............................................................................................... 29
Lab Objectives ...........................................................................................................................29
3.0 Load Lab Configuration .......................................................................................................29
3.1 Create Tags ..........................................................................................................................30
3.2 Create a Source NAT Policy ................................................................................................31

© 2018 Palo Alto Networks, Inc. Page 3

 3.3 Create Security Policy Rules................................................................................................32
3.4 Verify Internet Connectivity ................................................................................................33
3.5 Create an FTP Service..........................................................................................................33
3.6 Create a Destination NAT Policy.........................................................................................33
3.7 Create a Security Policy Rule ..............................................................................................34
3.8 Test the Connection .............................................................................................................35
4. Lab: App-ID .............................................................................................................................. 38
Lab Objectives ...........................................................................................................................38
4.0 Load Lab Configuration .......................................................................................................38
4.1 Create App-ID Security Policy Rule ....................................................................................39
4.2 Enable Interzone Logging ....................................................................................................39
4.3 Enable the Application Block Page .....................................................................................40
4.4 Test Application Blocking ...................................................................................................40
4.5 Review Logs ........................................................................................................................41
4.6 Test Application Blocking ...................................................................................................41
4.7 Review Logs ........................................................................................................................42
4.8 Modify the App-ID Security Policy Rule ............................................................................42
4.9 Test App-ID Changes...........................................................................................................42
4.10 Migrate Port-Based Rule to Application-Aware Rule .......................................................43
4.11 Observe the Application Command Center .......................................................................44
5. Lab: Content-ID ........................................................................................................................ 47
Lab Objectives ...........................................................................................................................47
5.0 Load Lab Configuration .......................................................................................................47
5.1 Create Security Policy Rule with an Antivirus Profile ........................................................48
5.2 Test Security Policy Rule .....................................................................................................49
5.3 Review Logs ........................................................................................................................50
5.4 Create Security Policy Rule with an Anti-Spyware Profile .................................................51
5.5 Create DMZ-Access Security Policy ...................................................................................53
5.6 Configure DNS-Sinkhole External Dynamic List ...............................................................54

© 2018 Palo Alto Networks, Inc. Page 4

 5.7 Anti-Spyware Profile with DNS Sinkhole ...........................................................................55
5.8 Test Security Policy Rule .....................................................................................................56
5.9 Review Logs ........................................................................................................................57
5.10 Create Security Policy Rule with a Vulnerability Protection Profile .................................58
5.11 Test Security Policy Rule ...................................................................................................59
5.12 Review Logs ......................................................................................................................60
5.13 Update Vulnerability Profile ..............................................................................................61
5.14 Create Group Security Profiles ..........................................................................................61
5.15 Create a File Blocking Profile ............................................................................................63
5.16 Modify Security Profile Group ..........................................................................................64
5.17 Test the File Blocking Profile ............................................................................................65
5.18 Multi-level Encoding .........................................................................................................66
5.19 Modify Security Policy Rule..............................................................................................66
5.20 Test the File Blocking Profile with Multi-level Encoding .................................................67
5.21 Modify Security Policy Rule..............................................................................................67
5.22 Test the File Blocking Profile with Multi-Level-Encoding ...............................................67
5.23 Create Danger Security Policy Rule ..................................................................................68
5.24 Generate Threats ................................................................................................................69
5.25 Modify Security Profile Group ..........................................................................................70
5.26 Generate Threats ................................................................................................................70
6. Lab: URL Filtering ................................................................................................................... 72
Lab Objectives ...........................................................................................................................72
6.0 Load Lab Configuration .......................................................................................................72
6.1 Create a Security Policy Rule with a Custom URL Category .............................................73
6.2 Test Security Policy Rule .....................................................................................................75
6.3 Review Logs ........................................................................................................................75
6.4 Configure an External Dynamic List ...................................................................................76
6.5 Test Security Policy Rule .....................................................................................................77
6.6 Review Logs ........................................................................................................................77

© 2018 Palo Alto Networks, Inc. Page 5

 6.7 Create a Security Policy Rule with URL Filtering Profile ...................................................78
6.8 Test Security Policy Rule with URL Filtering Profile .........................................................79
6.9 Review Logs ........................................................................................................................79
7. Lab: Decryption ........................................................................................................................ 81
Lab Objectives ...........................................................................................................................81
7.0 Load Lab Configuration .......................................................................................................81
7.1 Test Firewall Behavior Without Decryption ........................................................................82
7.2 Create Two Self-Signed Certificates ....................................................................................83
7.3 Create Custom Decryption URL Category ..........................................................................84
7.4 Create Decryption Policy .....................................................................................................85
7.5 Test AV Security Profile with the Decryption Policy..........................................................86
7.6 Export the Firewall Certificate .............................................................................................87
7.7 Import the Firewall Certificate .............................................................................................87
7.8 Test the Decryption Policy ...................................................................................................88
7.9 Review Logs ........................................................................................................................90
7.10 Test URL Filtering with Decryption ..................................................................................91
8. Lab: WildFire ............................................................................................................................ 93
Lab Objectives ...........................................................................................................................93
8.0 Load Lab Configuration .......................................................................................................93
8.1 Create a WildFire Analysis Profile ......................................................................................94
8.2 Modify Security Profile Group ............................................................................................94
8.3 Test the WildFire Analysis Profile.......................................................................................95
9. Lab: User-ID ............................................................................................................................. 98
Lab Objectives ...........................................................................................................................98
9.0 Load Lab Configuration .......................................................................................................98
9.1 Enable User-ID on the Inside Zone ......................................................................................99
9.2 Configure the LDAP Server Profile .....................................................................................99
9.3 Configure User-ID Group Mapping ...................................................................................100
9.4 Configure Integrated Firewall Agent .................................................................................101

© 2018 Palo Alto Networks, Inc. Page 6

 9.5 Verify User-ID Configuration ............................................................................................102
9.6 Review Logs ......................................................................................................................104
9.7 Create Security Policy Rule ...............................................................................................104
9.8 Review Logs ......................................................................................................................105
10. Lab: GlobalProtect ................................................................................................................ 107
Lab Objectives .........................................................................................................................107
10.0 Load Lab Configuration ...................................................................................................107
10.1 Configure a Subinterface .................................................................................................108
10.2 Generate Self-Signed Certificates ....................................................................................109
10.3 Configure the SSL-TLS Service Profile ..........................................................................111
10.4 Verify the LDAP Server Profile .......................................................................................112
10.5 Configure the Authentication Profile ...............................................................................113
10.6 Configure the Tunnel Interface ........................................................................................113
10.7 Configure the Internal Gateway .......................................................................................114
10.8 Configure the External Gateway ......................................................................................115
10.9 Configure the Portal .........................................................................................................116
10.10 Host the GlobalProtect Agent on the Portal ...................................................................118
10.11 Create Security Policy Rule ...........................................................................................118
10.12 Create a No-NAT Rule ..................................................................................................119
10.13 Download the GlobalProtect Agent ...............................................................................120
10.14 Connect to the External Gateway...................................................................................121
10.15 View User-ID Information .............................................................................................123
10.16 Disconnect the Connected User .....................................................................................123
10.17 Configure DNS Proxy ....................................................................................................124
10.18 Connect to the Internal Gateway ....................................................................................125
10.19 Reset DNS ......................................................................................................................125
11. Lab: Site-to-Site VPN ........................................................................................................... 127
Lab Objectives .........................................................................................................................127
11.0 Load Lab Configuration ...................................................................................................127

© 2018 Palo Alto Networks, Inc. Page 7

 11.1 Configure the Tunnel Interface ........................................................................................128
11.2 Configure the IKE Gateway .............................................................................................128
11.3 Create an IPSec Crypto Profile ........................................................................................129
11.4 Configure the IPsec Tunnel..............................................................................................130
11.5 Add a Static Route for the VPN .......................................................................................130
11.6 Create Security Policy Rule .............................................................................................131
11.7 Test Connectivity .............................................................................................................132
12. Lab: Monitoring and Reporting ............................................................................................ 134
Lab Objectives .........................................................................................................................134
12.0 Load Lab Configuration ...................................................................................................134
12.1 Generate Traffic ...............................................................................................................134
12.2 Explore the Session Browser ...........................................................................................135
12.3 Explore App Scope ..........................................................................................................136
12.4 Explore the ACC ..............................................................................................................140
12.5 Investigate Traffic ............................................................................................................144
12.6 User Activity Report ........................................................................................................147
12.7 Create a Custom Report ...................................................................................................147
12.8 Create a Report Group .....................................................................................................149
12.9 Schedule Report Group Email .........................................................................................150
13. Lab: Active/Passive High Availability ................................................................................. 152
Lab Objectives .........................................................................................................................152
13.0 Load Lab Configuration ...................................................................................................152
13.1 Display the HA Widget ....................................................................................................153
13.2 Configure the HA Interface ..............................................................................................153
13.3 Configure Active/Passive HA ..........................................................................................154
13.4 Configure HA Monitoring ...............................................................................................156
13.5 Observe the Behavior of the HA Widget .........................................................................157
14. Lab: Capstone .................................................................................................................. 159
14.0 Load Lab Configuration ............................................................................................159

© 2018 Palo Alto Networks, Inc. Page 8

 14.1 Configure Interfaces and Zones .............................................................................160
14.2 Configure Security and NAT Policy Rules...........................................................160
14.3 Create and Apply Security Profiles .......................................................................161
14.4 Configure GlobalProtect...........................................................................................162

© 2018 Palo Alto Networks, Inc. Page 9

Typographical Conventions
This guide uses the following typographical conventions for special terms and instructions.
Convention Meaning Example

Bolding Names of selectable items in Click Security to open the Security Rule
the web interface Page

Consolas font Text that you enter and Enter the following command:
coding examples a:\setup
The show arp all command yields this
output:
username@hostname> show arp
<output>

Click Click the left mouse button Click Administrators under the Device
tab

Right-click Click the right mouse button Right-click the number of a rule you want
to copy, and select Clone Rule

< > (text enclosed Parameter in the Lab Settings Click Add again and select <Internal
in angle brackets) Handout Interface>

© 2018 Palo Alto Networks, Inc. Page 10

How to Use This Lab Guide
The Lab Guide contains exercises that correspond to modules in the Student Guide. Each lab
exercise consists of step-by-step, task-based labs. The final lab is based on a scenario that you
will interpret and use to configure a comprehensive firewall solution.
The following diagram provides a basic overview of the lab environment:

© 2018 Palo Alto Networks, Inc. Page 11

1. Lab: Initial Configuration
Lab Objectives
▪ Load a configuration.
▪ Create an administrator role.
▪ Create a new administrator and apply an administrator role.
▪ Observe the newly created role permissions via the CLI and web interface.
▪ Create and test a commit lock.
▪ Configure DNS servers for the firewall.
▪ Schedule dynamic updates.

1.0 Connect to Your Student Firewall

1. Launch a browser and connect to https://192.168.1.254.
2. Log in to the Palo Alto Networks firewall using the following:
Parameter Value
Name admin
Password admin

1.1 Apply a Baseline Configuration to the Firewall

3. In the Palo Alto Networks firewall web interface, select Device > Setup > Operations.
4. Click Load named configuration snapshot:

5. Click the drop-down list next to the Name text box and select edu-210-lab-01.
6. Click OK. After some time, a confirmation that the configuration is being loaded
appears.
7. Click Close.

© 2018 Palo Alto Networks, Inc. Page 12

 8. Click on the bottom right corner and verify that the config has been loaded
successfully

9. Click the Commit link at the top right of the web interface. Click Commit and wait until
the commit process is complete. Click Close to continue.

Note: Continue if you are warned about a full commit.

1.2 Add an Admin Role Profile

Admin Role Profiles are custom roles that determine the access privileges and responsibilities of
administrative users.

10. Select Device > Admin Roles.

11. Click Add in the lower-left corner of the panel to create a new administrator role:

12. Enter the name policy-admins-role.

13. Click the Web UI tab. Click the icon to disable the following:
Parameter Value
Monitor
Network
Device
Privacy

14. Click the XML API tab and verify that all items are disabled.
15. Click the Command Line tab and verify that the selection is None.

16. Click to continue.

1.3 Add an Administrator Account

17. Select Device > Administrators.

© 2018 Palo Alto Networks, Inc. Page 13

 18. Click in the lower-left corner of the panel to open the Administrator
configuration window.
19. Configure the following:
Parameter Value
Name policy-admin
Authentication Profile None
Password paloalto
Administrator Type

Profile policy-admins-role
Password Profile None

20. Click OK.

21. Click the Commit link at the top right of the web interface. Click Commit and wait until
the commit process is complete. Click Close to continue.

1.4 Test the policy-admin User

22. Open PuTTY from the Windows desktop.

23. Double-click firewall-management:

24. Log in using the following information:

Parameter Value
Name admin
Password admin

The role assigned to this account is allowed CLI access, so the connection should succeed.

25. Close the PuTTY window and then open PuTTY again.
26. Double-click firewall-management.

© 2018 Palo Alto Networks, Inc. Page 14

 27. Log in using the following information (the window will close if authentication is
successful):
Parameter Value
Name policy-admin
Password paloalto

The PuTTY window closes because the Admin Role assigned to this account denies CLI
access.
28. Open a different browser (not a tab) in private/incognito mode and browse to
https://192.168.1.254. A Certificate Warning might appear.
29. Click through any Certificate Warning. The Palo Alto Networks firewall login page
opens.
30. Log in using the following information (this action must be done in a different browser):
Parameter Value
Name policy-admin
Password paloalto

31. Close the Welcome window if one is presented.

32. Explore the available functionality of the web interface. Notice that several tabs and
functions are excluded from the interface because of the Admin Role assigned to this user
account:

1.5 Take a Commit Lock and Test the Lock

The web interface supports multiple concurrent administrator sessions by enabling an
administrator to lock the candidate or running configuration so that other administrators cannot
change the configuration until the lock is removed.
33. From the web interface where you are logged in as policy-admin, click the transaction
lock icon to the right of the Commit link. The Locks windows opens.

34. Click Take Lock in the lower-left corner of the panel. A Take lock window opens.
35. Set the Type to Commit, and click OK. The policy-admin lock is listed in the Locks
window.
36. Click Close to close the Locks window.
37. Click the Logout button on the lower-left corner of the web interface:

© 2018 Palo Alto Networks, Inc. Page 15

 38. Close the policy-admin browser window.
39. Return to the web interface where you are logged in as the admin account.
40. Click the Device > Administrators link. The web interface refreshes. Notice the lock
icon in the upper-right corner of the web interface.

41. Click to add another administrator account.

42. Configure the following:

Parameter Value
Name test-lock
Authentication Profile None
Password paloalto
Administrator Type

Profile policy-admins-role
Password Profile None

43. Click OK. The new test-lock user is listed.

44. all changes. Although you could add a new administrator account, you are not
allowed to commit the changes because of the Commit lock set by the policy-admin user:

45. Click Close.

46. Click the transaction lock icon in the upper-right corner:

47. Select the policy-admin lock and click Remove Lock:

Note: The user that took the lock or any superuser can remove a lock.

© 2018 Palo Alto Networks, Inc. Page 16

 48. Click OK and the lock is removed from the list.
49. Click Close.
50. Now that the lock is removed, changes can be committed. all changes.

51. Select the test-lock user and then click to delete the test-lock user.
52. Click Yes to confirm the deletion.
53. all changes.

1.6 Verify the Update and DNS Servers

The DNS server configuration settings are used for all DNS queries that the firewall initiates in
support of FQDN address objects, logging, and firewall management.
54. Select Device > Setup > Services.
55. Open the Services window by clicking the icon in the upper-right corner of the
Services panel:

56. Verify that 4.2.2.2 is the Primary DNS Server and that 8.8.8.8 is the Secondary DNS
Server.
57. Verify that updates.paloaltonetworks.com is the Update Server.
58. Click OK.

1.7 Schedule Dynamic Updates

Palo Alto Networks regularly posts updates for application detection, threat protection, and
GlobalProtect data files through dynamic updates.

59. Select Device > Dynamic Updates.

60. Locate and click the Schedule hyperlink on the far right of Antivirus:

The scheduling window opens. Antivirus signatures are released daily.

61. Configure the following:
Parameter Value

© 2018 Palo Alto Networks, Inc. Page 17

 Recurrence Hourly
Time 13 Minutes Past Hour
Action download-and-install

62. Click OK.

63. Locate and click the Schedule hyperlink on the far right of Application and Threats.
The scheduling window opens. Application and Threat signatures are released weekly.
64. Configure the following:
Parameter Value
Recurrence Daily
Time 01:05
Action download-and-install
Threshold 8 hours

65. Click OK.

66. Locate and click the Schedule hyperlink on the far right of WildFire. The scheduling
window opens. WildFire® signatures can be available within five minutes.
67. Configure the following:
Parameter Value
Recurrence Every Minute
Action download-and-install

68. Click OK.

69. all changes.

Stop. This is the end of the Initial Configuration lab.

© 2018 Palo Alto Networks, Inc. Page 18

2. Lab: Interface Configuration

Lab Objectives
▪ Create Security zones two different ways and observe the time saved.
▪ Create Interface Management Profiles to allow ping and responses pages.
▪ Configure Ethernet interfaces to observe DHCP client options and static configuration.
▪ Create a virtual router and attach configured Ethernet interfaces.
▪ Test connectivity with automatic default route configuration and static configuration.

2.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

© 2018 Palo Alto Networks, Inc. Page 19

 3. Select edu-210-lab-02 and click OK.
4. Click Close.
5. all changes.

2.1 Create New Security Zones

Security zones are a logical way to group physical and virtual interfaces on the firewall to control
and log the traffic that traverses your network through the firewall. An interface on the firewall
must be assigned to a Security zone before the interface can process traffic. A zone can have
multiple interfaces of the same type (for example, Tap, Layer 2, or Layer 3 interfaces) assigned
to it, but an interface can belong to only one zone.

6. Select Network > Zones.

7. Click to create a new zone. The Zone configuration window opens.

8. Configure the following:
Parameter Value
Name outside
Type Layer3

9. Click OK to close the Zone configuration window. The outside zone is the only zone
created in this task. You will add an Ethernet interface to this zone in a later lab step.

2.2 Create Interface Management Profiles

An Interface Management Profile protects the firewall from unauthorized access by defining the
services and IP addresses that a firewall interface permits. You can assign an Interface
Management Profile to Layer 3 Ethernet interfaces (including subinterfaces) and to logical
interfaces (Aggregate, VLAN, Loopback, and Tunnel interfaces).

10. Select Network > Network Profiles > Interface Mgmt.

11. Click to open the Interface Management Profile configuration window.

12. Configure the following:
Parameter Value
Name ping-response-pages

© 2018 Palo Alto Networks, Inc. Page 20

 Parameter Value
Permitted Services

13. Click OK to close the Interface Management Profile configuration window.

14. Click to create another Interface Management Profile.

15. Configure the following:
Parameter Value
Name ping
Permitted Services

16. Click OK to close the Interface Management Profile configuration window.

2.3 Configure Ethernet Interfaces

17. Select Network > Interfaces > Ethernet.
18. Click to open ethernet1/2.
19. Configure the following:
Parameter Value
Comment inside interface
Interface Type Layer3
Virtual Router None

20. Click the Security Zone drop-down list and select New Zone:

The Zone configuration window opens.

21. Configure the following:
Parameter Value
Name inside
Type Verify that the type is set to Layer3

22. Click OK to close the Zone configuration window.

23. Click the Ethernet Interface IPv4 tab.

© 2018 Palo Alto Networks, Inc. Page 21

 24. Configure the following:
Parameter Value
Type Static
IP Click Add and type 192.168.1.1/24

25. Click the Advanced tab.

26. Click the Management Profile drop-down list and select ping-response-pages.
27. Click OK to close the Ethernet Interface configuration window.
28. Click ethernet1/3 to open the interface.
29. Configure the following:
Parameter Value
Comment dmz interface
Interface Type Layer3
Virtual Router None

30. Click the Security Zone drop-down list and select New Zone. The Zone configuration
window opens.
31. Configure the following:
Parameter Value
Name dmz
Type Verify that the type is set to Layer3

32. Click OK to close the Zone configuration window.

33. Click the IPv4 tab.
34. Configure the following:
Parameter Value
Type Static
IP Click Add and type 192.168.50.1/24

35. Click the Advanced tab.

36. Click the Management Profile drop-down list and select ping.
37. Click OK to close the Ethernet Interface configuration window.
38. Click to open ethernet1/1.
39. Configure the following:

© 2018 Palo Alto Networks, Inc. Page 22

 Parameter Value
Comment outside interface
Interface Type Layer3
Virtual Router None
Security Zone outside

40. Click the IPv4 tab and configure the following:

Parameter Value
Type DHCP Client

Note the option.

This option automatically will install a default route based on DHCP-option 3.
41. Click OK to close the Ethernet Interface configuration window.
42. Click ethernet1/4 to open the interface.
43. Configure the following:
Parameter Value
Comment vWire zone named danger
Interface Type Virtual Wire
Virtual Wire None

44. Click the Security Zone drop-down list and select New Zone. The Zone configuration
window opens.
45. Configure the following:
Parameter Value
Name danger
Type Verify that the type is set to Virtual Wire

46. Click OK twice to close the Zone and Ethernet Interface configuration windows.
47. Click ethernet1/5 to open the interface.
48. Configure the following:
Parameter Value
Comment vWire zone named danger
Interface Type Virtual Wire
Virtual Wire None

© 2018 Palo Alto Networks, Inc. Page 23

 Parameter Value
Security Zone danger

49. Click OK to close the Ethernet Interface configuration window.

2.4 Create a Virtual Wire

A virtual wire interface binds two Ethernet ports together. A virtual wire interface allows all
traffic or just selected VLAN traffic to pass between the ports. No other switching or routing
services are available.

50. Select Network > Virtual Wires.

51. Click and configure the following:
Parameter Value
Name danger
Interface 1 ethernet1/4
Interface 2 ethernet1/5

52. Click OK.

2.5 Create a Virtual Router

The firewall requires a virtual router to obtain routes to other subnets either using static routes
that you manually define, or through participation in Layer 3 routing protocols that provide
dynamic routes.

53. Select Network > Virtual Routers.

54. Click the default virtual router.

© 2018 Palo Alto Networks, Inc. Page 24

 55. Rename the default router lab-vr.
56. Add the following interfaces: ethernet1/1, ethernet1/2, and ethernet1/3:

Note: This step also can be completed via each Ethernet Interface configuration
window.
57. Click OK.
58. all changes.

2.6 Test Connectivity

59. Open PuTTY from the Windows desktop.

60. Double-click firewall-management:

61. Log in using the following:

Parameter Value
Name admin
Password admin

© 2018 Palo Alto Networks, Inc. Page 25

 62. Enter the command show interface all to determine the IP address which the FireWall
received on interface ethernet1/1 via DHCP

63. Enter the command ping source 203.0.113.21 host 8.8.8.8.

Because a default route was automatically installed, you should be getting replies from
8.8.8.8:

64. Press Ctrl-C to stop the ping.

65. On the lab environment Windows desktop, open a command-prompt window.
66. Type the command ping 192.168.1.1:

67. Verify that you get a reply before proceeding.

68. Close the command-prompt window.

2.7 Modify Outside Interface Configuration

69. In the web interface select Network > Interfaces > Ethernet.
70. Select but, do not open ethernet1/1:

© 2018 Palo Alto Networks, Inc. Page 26

 71. Click , then click Yes.
72. all changes. This action will force the interface to release the former DHCP-
assigned IP address.
73. Click and open ethernet 1/1.
74. Configure the following:
Parameter Value
Comment outside interface
Interface Type Layer3
Virtual Router lab-vr
Security Zone outside

75. Click the IPv4 tab and configure the following:

Parameter Value
Type Static
IP 203.0.113.20/24

76. Click OK to close the Ethernet Interface configuration window.

77. Select Network > Virtual Routers.
78. Click to open the lab-vr virtual router.
79. Click the Static Routes vertical tab:

80. Click to configure the following static route:

Parameter Value
Name default-route
Destination 0.0.0.0/0
Interface ethernet1/1
Next Hop IP Address

© 2018 Palo Alto Networks, Inc. Page 27

 Parameter Value
Next Hop IP Address 203.0.113.1

81. Click OK to add the static route and then click OK again to close the Virtual Router –
lab-vr configuration window.
82. all changes.
83. Make the PuTTY window that was used to ping 8.8.8.8 the active window.
84. Type the command ping source 203.0.113.20 host 8.8.8.8.
You should be able to successfully ping 8.8.8.8:

85. Close the PuTTY window.

Stop. This is the end of the Interface Configuration lab.

© 2018 Palo Alto Networks, Inc. Page 28

3. Lab: Security and NAT Policies

Lab Objectives
▪ Create tags for later use with Security policy rules.
▪ Create a basic source NAT rule to allow outbound access and an associated Security
policy rule to allow the traffic.
▪ Create a destination NAT rule for the FTP server and an associated Security policy rule
to allow the traffic.

3.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

3. Select edu-210-lab-03 and click OK.

4. Click Close.

© 2018 Palo Alto Networks, Inc. Page 29

 5. all changes.

3.1 Create Tags

Tags enable you to group, sort and filter objects using keywords or phrases. Tags can be applied
to Address objects, Address Groups (static and dynamic), services, Service Groups, and policy
rules. Tags can be assigned a color that makes the results of a search easier to find in the web
interface. In the following steps, you will assign a description to a tag, assign the tag a color, and
apply the tag to different policies.

6. Select Objects > Tags.

7. Click to define a new tag.
8. Configure the following:
Parameter Value
Name Select danger
Color Purple

9. Click OK to close the Tag configuration window.

10. Click again to define another new tag.
11. Configure the following:
Parameter Value
Name egress
Color Blue

12. Click OK to close the Tag configuration window.

13. Click again to define another new tag.
14. Configure the following:
Parameter Value
Name Select dmz
Color Orange

15. Click OK to close the Tag configuration window.

16. Click again to define another new tag.
17. Configure the following:

© 2018 Palo Alto Networks, Inc. Page 30

 Parameter Value
Name internal
Color Yellow

18. Click OK to close the Tag configuration window.

3.2 Create a Source NAT Policy

19. Select Policies > NAT.
20. Click to define a new source NAT policy.
21. Configure the following:
Parameter Value
Name source-egress-outside
Tags egress

22. Click the Original Packet tab and configure the following:
Parameter Value
Source Zone inside
Destination Zone outside
Destination Interface ethernet1/1

23. Click the Translated Packet tab and configure the following:
Parameter Value
Translation Type Dynamic IP And Port
Address Type Interface Address
Interface ethernet1/1
IP Address Select 203.0.113.20/24 (Make sure to select the interface IP
address, do not type it.)

24. Click OK to close the NAT Policy Rule configuration window.

You will not be able to access the internet yet because you still need to configure a Security
policy to allow traffic to flow between zones.

© 2018 Palo Alto Networks, Inc. Page 31

3.3 Create Security Policy Rules
Security policy rules reference Security zones and enable you to allow, restrict, and track traffic
on your network based on the application, user or user group, and service (port and protocol).

25. Select Policies > Security.

26. Click to define a Security policy rule.
27. Configure the following:
Parameter Value
Name egress-outside
Rule Type universal (default)
Tags egress

28. Click the Source tab and configure the following:

Parameter Value
Source Zone inside
Source Address Any

29. Click the Destination tab and configure the following:

Parameter Value
Destination Zone outside
Destination Address Any

30. Click the Application tab and verify that is selected.

31. Click the Service/URL Category tab and verify that is selected.
32. Click the Actions tab and verify the following:
Parameter Value
Action Setting Allow
Log Setting Log at Session End

33. Click OK to close the Security Policy Rule configuration window.

34. all changes.

© 2018 Palo Alto Networks, Inc. Page 32

3.4 Verify Internet Connectivity
35. Test internet connectivity by opening a different browser in private/incognito mode and
browse to msn.com and shutterfly.com.
36. In the web interface select Monitor > Logs > Traffic.
37. Traffic log entries should be present based on the internet test. Verify that there is
allowed traffic that matches the Security policy rule egress-outside. This process may
take a minute or two for the log files to be updated:

3.5 Create an FTP Service

When you define Security policy rules for specific applications, you can select one or more
services that limit the port numbers that the applications can use.

38. In the web interface select Objects > Services.

39. Click to create a new service using the following:
Parameter Value
Name service-ftp
Destination Port 20-21

40. Click OK to close the Service configuration window.

3.6 Create a Destination NAT Policy

You are configuring destination NAT in the lab to get familiar with how destination NAT works,
not because it is necessary for the lab environment. (No outside host will attempt to connect to an
internal server.)
41. In the web interface select Policies > NAT.
42. Click to define a new destination NAT policy rule.
43. Configure the following:
Parameter Value
Name destination-dmz-ftp
Tags internal

© 2018 Palo Alto Networks, Inc. Page 33

 44. Click the Original Packet tab and configure the following:
Parameter Value
Source Zone inside
Destination Zone inside
Destination Interface ethernet1/2
Service service-ftp
Destination Address 192.168.1.1

45. Click the Translated Packet tab and configure the following:
Parameter Value
Destination Address Static IP
Translation Type
Translated Address 192.168.50.10 (address of DMZ server)

46. Click OK to close the NAT Policy configuration window.

3.7 Create a Security Policy Rule

47. Click the Dashboard tab.

48. Note the current time referenced by the firewall:

49. Select Policies > Security.

50. Click to define a new Security policy rule.
51. Configure the following:
Parameter Value
Name internal-dmz-ftp
Rule Type universal (default)
Tags internal

52. Click the Source tab and configure the following:

© 2018 Palo Alto Networks, Inc. Page 34

 Parameter Value
Source Zone inside

53. Click the Destination tab and configure the following:

Parameter Value
Destination Zone dmz
Destination Address 192.168.1.1

54. Click the Service/URL Category tab and configure the following:
Parameter Value
Service service-ftp

55. Click the Actions tab and verify that Allow is selected.
56. Locate the Schedule drop-down list and select New Schedule:

By default, Security policy rules always are in effect (all dates and times). To limit a
Security policy to specific times, you can define schedules and then apply them to the
appropriate policy rules.
57. Configure the following:
Parameter Value
Name internal-dmz-ftp
Recurrence Daily
Start Time 5 minutes from the time noted in Step 48 (firewall time)
End time 2 hours from the current firewall time.

Note: Input time in a 24-hour format.

58. Click OK to close the Schedule configuration window.
59. Click OK to close the Security Policy Rule configuration window.
60. all changes.

3.8 Test the Connection

61. Wait for the scheduled time to start for the internal-dmz-ftp Security policy rule.

© 2018 Palo Alto Networks, Inc. Page 35

 62. Open a new Chrome browser window in private mode and browse to
ftp://192.168.1.1.
63. At the prompt for login information, enter the following:
Parameter Value
User Name lab-user
Password paloalto

192.168.1.1 is the inside interface address on the firewall. The firewall is not hosting the
FTP server. The fact that you were prompted for a username indicates that FTP was
allowed through the firewall using the destination NAT.
64. Verify that you can view the directory listing, and then close the Chrome browser
window:

65. In the web interface select Monitor > Logs > Traffic.
66. Find the entries where the application ftp has been allowed by rule internal-dmz-ftp.
Notice the Destination address and rule matching:

© 2018 Palo Alto Networks, Inc. Page 36

 Stop. This is the end of the Security and NAT Policies lab.

© 2018 Palo Alto Networks, Inc. Page 37

4. Lab: App-ID

Lab Objectives
▪ Create an application-aware Security policy rule.
▪ Enable interzone logging.
▪ Enable the Application Blocked page for blocked applications.
▪ Test application blocking with different applications
▪ Find the categories that match to the signature web-browsing
▪ Migrate older port-based rules to application-aware policies.
▪ Review logs associated with the traffic and browse the Application Command Center
(ACC).

4.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

© 2018 Palo Alto Networks, Inc. Page 38

 3. Select edu-210-lab-04 and click OK.
4. Click Close.
5. all changes.

4.1 Create App-ID Security Policy Rule

6. Select Policies > Security.
7. Select the egress-outside Security policy rule without opening it.

8. Click . The Clone configuration window opens.

9. Verify that Move top is selected on the Rule order drop-down list.
10. Click OK to close the Clone configuration window.
11. With the original egress-outside Security policy rule still selected, click .
Notice that the egress-public rule is now grayed out and in italics:

12. Click to open the cloned Security policy rule named egress-outside-1.
13. Configure the following:
Parameter Value
Name egress-outside-app-id

14. Click the Application tab and configure the following:

Parameter Value
Applications dns
facebook-base
ssl
web-browsing

15. Click OK to close the Security Policy Rule configuration window.

4.2 Enable Interzone Logging

The intrazone-default and interzone-default Security policy rules are read-only by default.

16. Click to open the interzone-default Security policy rule.

17. Click the Actions tab. Note that Log at Session Start and Log at Session End are
deselected, and cannot be edited:

© 2018 Palo Alto Networks, Inc. Page 39

 18. Click Cancel.

19. With the interzone-default policy rule selected but not opened, click . The
Security Policy Rule – predefined window opens.
20. Click the Actions tab.
21. Select Log at Session End.
22. Click OK.

4.3 Enable the Application Block Page

23. Select Device > Response Pages.
24. Click Disabled to the right of Application Block Page:

25. Select the Enable Application Block Page check box.

26. Click OK. The Application Block Page should now be enabled:

27. all changes.

4.4 Test Application Blocking

28. Open a new Internet Explorer browser window in private/incognito mode. You should be
able to browse to www.facebook.com and www.msn.com.
29. Use private/incognito mode in a browser to connect to http://www.shutterfly.com.
An Application Blocked page opens, indicating that the shutterfly application has been
blocked:

© 2018 Palo Alto Networks, Inc. Page 40

 Why could you browse to Facebook and MSN but not to Shutterfly? MSN currently does
not have a unique and specific Application signature. Therefore, App-ID identifies it
using the Application signature web-browsing. However, an Application signature exists
for Shutterfly, and currently it is not allowed in any of the firewall Security policy rules.
30. Browse to www.google.com using Internet Explorer and verify that google-base also is
being blocked:

4.5 Review Logs

31. Go to the web interface and select Monitor > Logs > Traffic.
32. Type (app eq shutterfly) in the filter text box.
33. Press the Enter key.
Only log entries whose Application is shutterfly are displayed.

4.6 Test Application Blocking

34. Try to work around the firewall’s denial of access to Shutterfly by using a web proxy. In
private/incognito mode in a browser, browse to avoidr.com.
35. Enter www.shutterfly.com in the text box near the bottom and click Go. An
Application Blocked page opens showing that the avoidr application was blocked:

© 2018 Palo Alto Networks, Inc. Page 41

4.7 Review Logs
36. Select Monitor > Logs > Traffic.
37. Type (app eq avoidr) in the filter text box. The Traffic log entries indicate that the
avoidr application has been blocked:

Based on the information from your log, Shutterfly and avoidr are denied by the
interzone-default Security policy rule.

Note: If the logging function of your interzone-default rule is not enabled, no information
would be provided via the Traffic log.

4.8 Modify the App-ID Security Policy Rule

38. In the web interface select Policies > Security.
39. Add shutterfly and google-base to the egress-outside-app-id Security policy rule.
40. Remove facebook-base from the egress-outside-app-id Security policy rule.
41. all changes.

4.9 Test App-ID Changes

42. Open a new Internet Explorer browser in private/incognito mode and browse to
www.shutterfly.com and www.google.com. The Application Blocked page no
longer is presented.
43. Open a new Internet Explorer browser window in private/incognito mode and browse to
http://www.facebook.com. Note: It should be http and not https as an Application
Blocked page cannot be display for webpages using SSL without SSL Decryption.
44. The Application Blocked page now appears for facebook-base.

© 2018 Palo Alto Networks, Inc. Page 42

 45. Close all browser windows except for the firewall web interface.
Note: The web-browsing Application signature applies to only browsing that does not
match any other Application signature.

4.10 Migrate Port-Based Rule to Application-Aware Rule

46. In the web interface select Policies > Security.
47. Click to open the internal-dmz-ftp Security policy rule:

48. Click the Application tab and add ftp.

49. Click the Service/URL Category tab.
50. Delete service-ftp and select application-default:

Selecting application-default does not change the service behavior because, in the
application database, FTP is allowed only on port 21 by default.
51. Click OK.
52. all changes.
53. Open a new Chrome browser window in incognito and browse to ftp://192.168.1.1.
54. At the prompt for login information, enter the following (credentials may be cached from
a previous login):
Parameter Value
User Name lab-user
Password paloalto

© 2018 Palo Alto Networks, Inc. Page 43

 Notice that the connection succeeds and that you can log in to the FTP server with the
updated Security policy rule.

4.11 Observe the Application Command Center

The Application Command Center (ACC is an analytical tool that provides actionable
intelligence on activity within your network. The ACC uses the firewall logs as the source for
graphically depicting traffic trends on your network. The graphical representation enables you to
interact with the data and visualize the relationships between events on the network, including
network use patterns, traffic patterns, and suspicious activity and anomalies.
55. Click the ACC tab to access the Application Command Center:

56. Note that the upper-right corner of the ACC displays the total risk level for all traffic that
has passed through the firewall thus far:

57. On the Network Activity tab, the Application Usage pane shows application traffic
generated so far (because log aggregation is required, 15 minutes might pass before the
ACC displays all applications):

© 2018 Palo Alto Networks, Inc. Page 44

 58. You can click any application listed in the Application Usage pane; google-base is used
in this example:

Notice that the Application Usage pane updates to present only google-base information.

59. Click the icon and select Traffic Log:

Once the Traffic Log is selected, you automatically are linked to the applicable log
information with the filter set for the google-base application:

© 2018 Palo Alto Networks, Inc. Page 45

 Stop. This is the end of the App-ID lab.

© 2018 Palo Alto Networks, Inc. Page 46

5. Lab: Content-ID

Lab Objectives
▪ Configure and test an Antivirus Security Profile.
▪ Configure and test an Anti-Spyware Security Profile.
▪ Configure and test the DNS Sinkhole feature with an External Dynamic List.
▪ Configure and test a Vulnerability Security Profile.
▪ Configure and test a File Blocking Security Profile.
▪ Use the Virtual Wire mode and configure the danger zone.
▪ Generate threats and observe the actions taken.

5.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

© 2018 Palo Alto Networks, Inc. Page 47

 3. Select edu-210-lab-05 and click OK.
4. Click Close.
5. all changes.

5.1 Create Security Policy Rule with an Antivirus Profile

Use an Antivirus Profile object to configure options to have the firewall scan for viruses on
traffic matching a Security policy rule.

6. Select Objects > Security Profiles > Antivirus.

7. Click to create an Antivirus Profile.
8. Configure the following:
Parameter Value
Name lab-av
Packet Capture

Decoder Set the Action column for http to reset-server

9. Click OK to close the Antivirus Profile configuration window.

10. Select Policies > Security.
11. Select the egress-outside-app-id Security policy rule without opening it:

12. Click . The Clone configuration window opens.

13. Verify that Move top is selected from the Rule order drop-down list.
14. Click OK to close the Clone configuration window.
15. With the original egress-outside-app-id still selected, click .
16. Click to open the cloned Security policy rule named egress-outside-app-id-1.
17. Configure the following:
Parameter Value
Name egress-outside-av
Tags egress

18. Click the Application tab and configure the following:

Parameter Value
Applications

© 2018 Palo Alto Networks, Inc. Page 48

 19. Click the Actions tab and configure the following:
Parameter Value
Profile Type Profiles
Profile Setting

20. Click OK to close the Security Policy Rule configuration window.

21. all changes.

5.2 Test Security Policy Rule

22. On your desktop, open a new browser in private/incognito mode and browse to
http://www.eicar.org.
23. Click the DOWNLOAD ANTIMALWARE TESTFILE image in the upper-right
corner:

24. Click the Download link on the left of the web page:

25. Within the Download area at the bottom of the page, click either the eicar.com or the
eicar.com.txt file to download the file using standard HTTP and not SSL-enabled
HTTPS. The firewall will not be able to detect the viruses in an HTTPS connection until
decryption is configured.

© 2018 Palo Alto Networks, Inc. Page 49

 26. If prompted, Save the file. Do not open or run the file.

27. Close the browser window.

5.3 Review Logs

28. In the web interface select Monitor > Logs > Threat.
29. Find the log message that detected the Eicar Test File. Notice that the action for the file
is reset-server:

30. Notice the icon on the left side of the entry for the Eicar Test File indicating that
there is a packet capture (pcap):

To view the packet capture through the Detailed Log View, first click the Detailed Log

view icon to open the Detailed Log View of the threat entry:

© 2018 Palo Alto Networks, Inc. Page 50

 From the Detailed Log View, click the icon to open the packet capture.
Here is an example of what a pcap might look like:

Captured packets can be exported in pcap format and examined with an offline analyzer
for further investigation.
31. After viewing the pcap, click Close.

5.4 Create Security Policy Rule with an Anti-Spyware Profile

32. Select Objects > Security Profiles > Anti-Spyware.

33. Click to create an Anti-Spyware Profile.

© 2018 Palo Alto Networks, Inc. Page 51

 34. Configure the following:
Parameter Value
Name lab-as
Rules tab Click Add and create a rule with these parameters:

▪ Rule Name: med-low-info

▪ Action: Select Alert
▪ Severity: Select only the Medium, Low, and
Informational check boxes
Click OK to save the rule.

Click Add and create another rule with these parameters:

▪ Rule Name: crit-high
▪ Action: Select Drop
▪ Severity: Select only the Critical and High check
boxes
Click OK to save the rule.

35. Click OK to close the Anti-Spyware Profile configuration window.

36. Select Policies > Security.
37. Select the egress-outside-av Security policy rule without opening it.

38. Click . The Clone configuration window opens.

39. Verify that Move top is selected from the Rule order drop-down list.
40. Click OK to close the Clone configuration window.
41. With the original egress-outside-av still selected, click .
42. Click to open the cloned Security policy rule named egress-outside-av-1.
43. Configure the following:
Parameter Value
Name egress-outside-as

© 2018 Palo Alto Networks, Inc. Page 52

 Parameter Value
Tags egress

44. Verify that the Source tab is configured as follows:

Parameter Value
Source Zone

45. Click the Actions tab and configure the following:

Parameter Value
Profile Type Profiles
Profile Setting

46. Click OK to close the Security Policy Rule configuration window.

5.5 Create DMZ-Access Security Policy

In the next section, you will configure the firewall to download an External Dynamic List (EDL)
of URLs from the DMZ server. You then will apply the EDL to the Anti-Spyware DNS
Sinkhole configuration. For the EDL and DNS Sinkhole configurations to work, you must create
a Security policy that allows the management interface to connect to the DMZ server. The
management interface establishes connections from the inside zone. The DMZ server responds
to connection requests from the dmz zone.
47. Select the internal-dmz-ftp Security policy rule without opening it.

48. Click . The Clone configuration window opens.

49. Verify that Move top is selected from the Rule order drop-down list.
50. Click OK to close the Clone configuration window.
51. With the original internal-dmz-ftp still selected, click .

© 2018 Palo Alto Networks, Inc. Page 53

 52. Click to open the cloned Security policy rule named internal-dmz-ftp-1.
53. Configure the following:
Parameter Value
Name internal-inside-dmz
Tags internal

54. Click the Destination tab and configure the following:

Parameter Value
Destination Address

55. Click the Application tab and configure the following:

Parameter Value
Applications web-browsing
ssl
ssh
ftp

56. Click OK to close the Security Policy Rule configuration window.

57. Select Policies > NAT.
58. Select the destination-dmz-ftp NAT policy rule without opening it.

59. Click .
60. all changes.

5.6 Configure DNS-Sinkhole External Dynamic List

An External Dynamic List (EDL) is an object that references an external list of IP addresses,
URLs, or domain names that can be used in policy rules. You must create this list as a text file
and save it to a web server that the firewall can access. By default, the firewall uses its
management port to retrieve the list items.

61. Select Objects > External Dynamic Lists.

62. Click to configure a new EDL.
63. Configure the following:
Parameter Value
Name lab-dns-sinkhole
Type Domain List

© 2018 Palo Alto Networks, Inc. Page 54

 Parameter Value
Source http://192.168.50.10/dns-sinkhole.txt (This is
hosted on the DMZ server.)
Repeat Five Minute

Note: This list currently contains “reddit.com” only.

64. Click OK to close the configuration window.
65. Open the lab-dns-sinkhole configuration you just created and click Test Source
URL:

66. Confirm that the firewall reports that the “Source URL is accessible” and click Close. If
the firewall reports a “URL access error,” check the source address, correct any errors,
and rerun the test.
67. Click OK to close the External Dynamic Lists configuration window.

5.7 Anti-Spyware Profile with DNS Sinkhole

The DNS Sinkhole action provides administrators with a method of identifying infected hosts on
the network using DNS traffic, even when the firewall cannot see the originator of the DNS
query because the DNS server is not on the internal network.
68. Select Objects > Security Profiles > Anti-Spyware.
69. Click to open the Anti-Spyware Profile named lab-as.
70. Click the DNS Signatures tab.

71. Click and select lab-dns-sinkhole.

72. Verify that the Action on DNS Queries is set to sinkhole:

© 2018 Palo Alto Networks, Inc. Page 55

 73. Verify that the Sinkhole IPv4 is set to 72.5.65.111.
74. Click OK to close the Anti-Spyware Profile configuration window.
75. all changes.

5.8 Test Security Policy Rule

76. From the Windows desktop, open a command-prompt window.
77. Type the nslookup command and press the Enter key.
78. Type the command server 8.8.8.8 and press the Enter key:

79. At the nslookup command prompt, type reddit.com. and press the Enter key:

Notice that the reply for reddit.com is 72.5.65.111. The request has been sinkholed.
80. Type exit and press the Enter key to exit nslookup. Then type exit and press the
Enter key again to exit the command-prompt window.
81. On the desktop, open a browser and go to http://reddit.com and wait for the
connection to timeout.

© 2018 Palo Alto Networks, Inc. Page 56

 Note: Make sure that you do not include “www.” in the URL, because “www.reddit.com”
is not in the EDL; “reddit.com” is currently the only entry in the list.
82. Close the browser window.

5.9 Review Logs

83. Select Monitor > Logs > Threat.
84. Identify the Suspicious Domain log entry. Notice that the action is sinkhole and that the
File Name column includes the DNS name that was queried (reddit.com):

85. Select Monitor > Logs > Traffic.

86. Type the following filter statement (addr.dst in 72.5.65.111) and press the
Enter key:

Notice that the Application type is “Incomplete” and the Session End Reason is “aged-
out.” These results occur because the sinkhole address does not reply to the connection
attempt made by the browser to reach reddit.com. The browser attempts to connect to the
sinkhole address because the firewall is blocking the original DNS request. The firewall
then returns a firewall-generated DNS reply that tells the browser that reddit.com is
located at the sinkhole address.
87. To find the original DNS request in the Traffic log, use the following filter statement
(addr.dst in 8.8.8.8) and (session_end_reason eq threat).

© 2018 Palo Alto Networks, Inc. Page 57

 88. Click the magnifying glass icon next to one of the entries to see the Detailed Log
View:

89. In the Detailed Log View notice the additional information that matches what you saw in
the Threat log. Next, scroll down and review the information in the Details section in the
middle column of the main display area. Notice that the traffic log records only one
packet. This packet is the original DNS query sent from the client. The DNS response
packet with the sinkhole address is sent directly from the firewall itself.

5.10 Create Security Policy Rule with a Vulnerability

Protection Profile
A Security policy rule can include specification of a Vulnerability Protection Profile that
determines the level of protection against buffer overflows, illegal code execution, and other
attempts to exploit system vulnerabilities.

90. Select Objects > Security Profiles > Vulnerability Protection.

91. Click to create a Vulnerability Protection Profile.
92. Configure the following:
Parameter Value
Name lab-vp

93. On the Rules tab, click to create a rule.

94. Configure the following:

© 2018 Palo Alto Networks, Inc. Page 58

 Parameter Value
Name lab-vp-rule
Packet Capture

Severity

95. Click OK twice.

96. Select Policies > Security.
97. Click to open the internal-inside-dmz Security policy rule.
98. Click the Actions tab and configure the following:
Parameter Value
Profile Type Profiles
Profile Setting

99. Click OK to close the Security Policy Rule configuration window.

100. all changes.

5.11 Test Security Policy Rule

101. On the Windows desktop, double-click the lab folder and then the bat files folder.

102. Double-click .

© 2018 Palo Alto Networks, Inc. Page 59

 Note: This action launches an FTP brute force attack at the DMZ FTP server. The
script should take about 10 minutes to complete.

103. After the script completes, press a key to close the command-prompt window.

5.12 Review Logs

104. Select Monitor > Logs > Threat.
105. Notice that you now have logs reflecting the FTP brute force attempt. However, the
firewall is set only to alert:

106. Open the Detailed Log View by clicking on the icon. From the Detailed Log
View, click the icon to open the packet capture.
107. Notice the username and password that were attempted along with the 530 response
from the FTP server.

© 2018 Palo Alto Networks, Inc. Page 60

5.13 Update Vulnerability Profile
108. Select Objects > Security Profiles > Vulnerability Protection.
109. Click to open the lab-vp profile.
110. Click to open the lab-vp-rule rule and configure the following:
Parameter Value
Action Reset Both
Severity high

111. Click OK twice.

112. all changes.

113. Rerun and review the logs to confirm that the new FTP brute force
attempts are reset.

5.14 Create Group Security Profiles

The firewall supports the ability to create Security Profile Groups, which specify sets of Security
Profiles that can be treated as a unit and then added to Security policy rules.

114. Select Objects > Security Profile Groups.

115. Click to open the Security Profile Group configuration window.

116. Configure the following:
Parameter Value
Name lab-spg

© 2018 Palo Alto Networks, Inc. Page 61

 Parameter Value
Profiles

117. Click OK.

118. Select Policies > Security.

119. the following rules:

Parameter Value
Security Policy Rules egress-outside-as
egress-outside-av

120. Click to define a Security policy rule.

121. Configure the following:
Parameter Value
Name egress-outside-content-id
Rule Type universal (default)
Tags egress

122. Click the Source tab and configure the following:

Parameter Value
Source Zone inside
Source Address Any

© 2018 Palo Alto Networks, Inc. Page 62

 123. Click the Destination tab and configure the following:
Parameter Value
Destination Zone outside
Destination Address Any

124. Click the Application tab and verify that is checked.

125. Click the Service/URL Category tab and verify that is

selected.
126. Click the Actions tab and configure the following:
Parameter Value
Action Setting Allow
Log Setting Log at Session End
Profile Setting

127. Click OK to close the Security Policy Rule configuration window.

5.15 Create a File Blocking Profile

A Security policy rule can include specification of a File Blocking Profile that blocks selected
file types from being uploaded or downloaded, or generates an alert when the specified file types
are detected.

128. In the web interface select Objects > Security Profiles > File Blocking.

129. Click to open the File Blocking Profile configuration window.

130. Configure the following:
Parameter Value
Name lab-file-blocking

131. Click and configure the following.

Parameter Value
Name block-pdf

© 2018 Palo Alto Networks, Inc. Page 63

 Parameter Value
Applications any
File Types pdf
Direction both
Action block

132. Click and configure the following:

Parameter Value
Name block-exe
Applications any
File Types dll
exe
PE
Direction both
Action block

Note: The file type pe is a group that includes .exe, .cpl, .dll, .ocx, .sys, .scr, .drv, .efi,
.fon, and .pif file types.
133. Click OK to close the File Blocking Profile configuration window.

5.16 Modify Security Profile Group

134. Select Objects > Security Profile Groups.
135. Click to open the lab-spg Security Profile Group.
136. Add the newly created File Blocking Profile:

© 2018 Palo Alto Networks, Inc. Page 64

 137. Click OK.
138. all changes.

5.17 Test the File Blocking Profile

139. Open a new browser window in private/incognito mode and browse to
http://www.panedufiles.com/.
140. Click the Panorama_AdminGuide.pdf link. The download fails:

Note: If you get “failed to download pdf” and not the block page, then refresh the
browser window.
141. Close the browser window.
142. Select Monitor > Logs > Data Filtering.
143. Find the log entry for the PDF file that has been blocked:

© 2018 Palo Alto Networks, Inc. Page 65

 Note: The Action column is located on the far right. You can move the column by using
the mouse cursor to drag-and-drop it.

5.18 Multi-level Encoding

A file that is encoded five or more times cannot be inspected by the firewall. Multi-Level
Encoding can be used to block this type of content.

144. In the web interface select Objects > Security Profiles > File Blocking.
145. Click to open the lab-file-blocking File Blocking Profile.

146. Click and configure the following:

Parameter Value
Name block-multi-level
Applications any
File Types Multi-Level-Encoding
Direction both
Action block

147. Click OK to close the File Blocking Profile configuration window.

5.19 Modify Security Policy Rule

148. In the web interface select Policies > Security.
149. Click to open the internal-inside-dmz Security policy rule.
150. Click the Actions tab and configure the following:
Parameter Value
Profile Setting

© 2018 Palo Alto Networks, Inc. Page 66

 151. Click OK to close the Security Policy Rule configuration window.
152. all changes.

5.20 Test the File Blocking Profile with Multi-level Encoding

153. Open a new browser in private/incognito mode and browse to
http://192.168.50.10/mle.zip. The URL links to a zip file that was compressed
five times.

The file is blocked in accordance with the new file blocking rule.
154. Close the browser window.

5.21 Modify Security Policy Rule

155. In the web interface select Objects > Security Profiles > File Blocking.
156. Click to open the lab-file-blocking File Blocking Profile.
157. Select the block-multi-level rule:

158. Change the Action to alert.

159. Click OK to close the File Blocking Profile configuration window.
160. all changes.

5.22 Test the File Blocking Profile with Multi-Level-Encoding

161. Open a new browser in private/incognito mode and browse to
http://192.168.50.10/mle.zip. The URL links to a file that was compressed
five times. The file no longer is blocked.
162. Save and open the file to examine the contents:

© 2018 Palo Alto Networks, Inc. Page 67

 Note: The illustration shows the recursive structure of the zip archive. You cannot
produce this view using Windows File Explorer.

5.23 Create Danger Security Policy Rule

Create a Security policy rule that references the danger Security zone for threat and traffic
generation.

163. In the web interface select Policies > Security.

164. Click and configure the following:
Parameter Value
Name danger-simulated-traffic

165. Click the Source tab and configure the following:

Parameter Value
Source Zone

166. Click the Destination tab and configure the following:

Parameter Value
Destination Zone

167. Click the Actions tab and configure the following:

Parameter Value
Profile Setting

168. Click OK to close the Security Policy Rule configuration window.

© 2018 Palo Alto Networks, Inc. Page 68

 169. Hover the mouse over the Name column header and select Adjust Columns from the
drop-down list:

Notice that the width of all the columns was adjusted to fit the text in the columns.
170. all changes.

5.24 Generate Threats

171. On the Windows desktop, open PuTTY and double-click traffic-generator.
172. Enter the following information when prompted:
Parameter Value
Password Pal0Alt0

173. In the PuTTY window, type the command sh /tg/malware.sh

174. Wait for the shell script to complete. Leave the PuTTY window open.
175. In the web interface select Monitor > Logs > Threat.
176. Type the filter (severity neq informational) and press the Enter key.
177. Notice the threats currently listed from the generated traffic:

Note: The Threat log entries that you see in your lab may not match exactly the image
above. Threat signatures, names, categorizations, and verdicts may change over time to
ensure that the firewall will consistently detect the packet captures. Two custom
Vulnerability signatures are included in the lab configuration that you loaded at the start
of this module. In your lab, at a minimum, you should see the Vulnerability detections
named Trojan-Win32.swrort.dfap and Ransom-Win32.locky.pe.

178. Select Monitor > Logs > Data Filtering.

179. Notice the blocked files:

© 2018 Palo Alto Networks, Inc. Page 69

5.25 Modify Security Profile Group
180. Select Objects > Security Profile Groups.
181. Click to open the lab-spg Security Profile Group.
182. Remove the File Blocking Profile:

183. Click OK.

184. all changes.

5.26 Generate Threats

185. In the PuTTY window named root@pod-dmz, type the command
sh /tg/malware.sh
186. Select Monitor > Logs > Threat.

© 2018 Palo Alto Networks, Inc. Page 70

 187. Verify that the filter (severity neq informational) is still active. If it is not,
type it in and press the Enter key.
188. Notice the blocked files and whether any new threats were detected. Turn off File
Blocking. Some files that were being blocked based on file type alone now may be
blocked based on the detection of malicious content:

Note: Because threat signatures, names, categorizations, and verdicts may change over
time, the log entries that you see in your lab may not match exactly the image above.

Stop. This is the end of the Content-ID lab.

© 2018 Palo Alto Networks, Inc. Page 71

6. Lab: URL Filtering

Lab Objectives
▪ Create a custom URL category and use it as a Security policy rule match criterion and as
part of a URL Filtering Profile.
▪ Configure and use an External Dynamic List (EDL) as a URL block list.
▪ Create a URL Filtering Profile and observe the difference between using url-categories in
a Security policy versus a profile.
▪ Review firewall log entries to identify all actions and changes.

6.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

© 2018 Palo Alto Networks, Inc. Page 72

 3. Select edu-210-lab-06 and click OK.
4. Click Close.
5. all changes.

6.1 Create a Security Policy Rule with a Custom URL

Category
Use a custom URL Category object to create your custom list of URLs and use it in a URL
Filtering Profile or as match criteria in Security policy rules. In a custom URL Category, you can
add URL entries individually, or import a text file that contains a list of URLs.

6. Select Objects > Custom Objects > URL Category.

7. Click to create a custom URL Category.
8. Configure the following:
Parameter Value
Name tech-sites
Sites newegg.com
engadget.com
techradar.com
*.newegg.com
*.engadget.com
*.techradar.com

9. Click OK to close the Custom URL Category configuration window.

10. Select Policies > Security.
11. Select the egress-outside-content-id Security policy rule without opening it:

12. Click . The Clone configuration window opens.

13. Verify that Move top is selected from the Rule order drop-down list.
14. Click OK to close the Clone configuration window.
15. With the original egress-outside-content-id Security policy rule still selected, click
.

© 2018 Palo Alto Networks, Inc. Page 73

 16. Notice that the egress-outside-content-id is now grayed out and in italics:

17. Click to open the cloned Security policy rule named egress-outside-content-id-1.
18. Configure the following:
Parameter Value
Name egress-outside-url

19. Click the Application tab and configure the following:

Parameter Value
Applications

20. Click the Service/URL Category tab and configure the following:
Parameter Value
URL Category

21. Click the Actions tab and configure the following:

Parameter Value
Action Setting Reset both client and server
Log Setting

Profile Setting

22. Click OK to close the Security Policy Rule configuration window.

23. Hover the mouse over the Name column and click the down-arrow:

24. Expand the Columns menu using the right-arrow and verify that the URL Category
check box is selected.
25. Enable the rule egress-outside.
Note: Because you created a rule that resets traffic, you need to enable the egress-outside
rule to allow everything else.

© 2018 Palo Alto Networks, Inc. Page 74

 26. all changes.

6.2 Test Security Policy Rule

27. Open a browser in private/incognito mode and browse to newegg.com:

The URL is blocked by the Security policy rule named egress-outside-url.

28. In the same browser window verify that techradar.com is blocked.
29. In the same browser window, determine if https://www.engadget.com also is blocked.
Note that this is an SSL connection. Because the firewall is not decrypting traffic, the
firewall resets the connection but does not generate a URL block page. If the firewall
intercepted this connection and generated a URL block page, the browser (depending on
the type) would assume and possibly report a man-in-the-middle attack.

6.3 Review Logs

30. In the web interface select Polices > Security and hover over the egress-outside-url
Security policy rule, click the down-arrow, and select Log Viewer to open the Traffic
log:

31. Notice that the firewall adds ( rule eq ‘egress-outside-url’ ) to the Traffic
log filter text box:

32. Click the down-arrow on any column header to add the URL Category column to the
Traffic log display.
33. Select the URL Filtering log.

© 2018 Palo Alto Networks, Inc. Page 75

 34. Notice that the URL Filtering log includes the Category and URL columns by default:

6.4 Configure an External Dynamic List

An External Dynamic List is an object that references an external list of IP addresses, URLs, or
domain names that can be used in policy rules.
35. Open WinSCP on the Windows desktop.

36. Double-click the list item edl-webserver.

37. Locate the text file in the right window pane named block-list.txt.
38. Right-click the block-list.txt file and select Edit.
39. Verify that the following URLs exist, each followed by a line break:
gizmodo.com
lifehacker.com
avsforum.com
reddit.com

40. Save the file if you made modifications, and Close the file.
41. Close the WinSCP window.
42. In the web interface select Objects > External Dynamic Lists.
43. Click to configure a new External Dynamic List.

© 2018 Palo Alto Networks, Inc. Page 76

 44. Configure the following:
Parameter Value
Name url-block-list
Type URL List
Source http://192.168.50.10/block-list.txt
Repeat Five Minute

45. Click OK to close the External Dynamic Lists configuration window.

46. Go to Policies > Security.
47. Click to open the Security policy rule named egress-outside-url.
48. Click the Service/URL Category tab.
49. Add the newly created External Dynamic List to the URL Category list:

50. Click OK to close the Security Policy Rule configuration window.

51. all changes.

6.5 Test Security Policy Rule

52. Open a browser in private/incognito mode and browse to avsforum.com:

The URL is blocked by the Security policy rule named egress-outside-url.

53. In the same browser window verify that gizmodo.com and lifehacker.com also are
blocked.

6.6 Review Logs

54. In the web interface select Monitor > Logs > URL Filtering.

© 2018 Palo Alto Networks, Inc. Page 77

 55. Notice the new category and action:

6.7 Create a Security Policy Rule with URL Filtering Profile

56. Select Objects > Security Profiles > URL Filtering.
57. Click to define a URL Filtering Profile.
58. Configure the following:
Parameter Value
Name lab-url-filtering

59. Click the Categories tab.

60. Search the Category field for the following three categories and set the Site Access to
block:

shopping
government
hacking
61. Search for url-block-list and tech-sites. Notice that your custom URL categories are also
listed and they are set to a Site Access of “allow.” Leave them set to “allow.”
62. Click OK to close the URL Filtering Profile window.
63. Select Device > Licenses.
64. Under the PAN-DB URL Filtering header, click Download Now (or Re-Download).
Click Yes if a warning appears.
65. Select the region nearest the location of your firewall and click OK.
After the download completes, a Download Successful window appears.
66. Click Close to close the download status window. The web interface now should show a
message similar to the following:

67. Select Policies > Security.

68. Click to open the Security policy rule named egress-outside-url.
69. Click the Service/URL Category tab.
70. Select above the URL Category list.
71. Click the Actions tab and configure the following:

© 2018 Palo Alto Networks, Inc. Page 78

 Parameter Value
Action Allow
Profile Setting

72. Click OK to close the Security Policy Rule configuration window.

73. the egress-outside rule.
Note: You can disable the egress-outside rule because the URL Filtering Profile is being
used and the egress-outside-url Security policy rule now allows traffic.
74. all changes.

6.8 Test Security Policy Rule with URL Filtering Profile

75. Open a different browser (not a new tab) in private/incognito mode and browse to
www.newegg.com. The URL www.newegg.com belongs to the shopping URL category.
Based on the Security policy rule named egress-outside-url, the URL is now allowed
even though you chose to block the shopping category because your custom URL
category has newegg.com listed and is set to “allow,” and your custom category is
evaluated before the Palo Alto Networks URL categories.
76. In the same browser window verify that http://www.transportation.gov
(government) and http://www.2600.org (hacking) are blocked.
77. Close all browser windows except for the firewall web interface.

6.9 Review Logs

78. Select Monitor > Logs > URL Filtering.
79. Review the actions taken on the following entries:

© 2018 Palo Alto Networks, Inc. Page 79

 You should see entries for 2600.org and transportation.gov. No log is shown for
newegg.com because it is matching the Custom URL Category “tech-sites” which has an
action “allow” and therefore does not generate any logs.

Stop. This is the end of the URL Filtering lab.

© 2018 Palo Alto Networks, Inc. Page 80

7. Lab: Decryption

Lab Objectives
▪ Observe firewall behavior without decryption.
▪ Create Forward Trust and Untrust certificates.
▪ Create a custom decryption category.
▪ Create a Decryption policy.
▪ Observe firewall behavior after decryption is enabled.
▪ Review logs.

7.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

3. Select edu-210-lab-07 and click OK.

© 2018 Palo Alto Networks, Inc. Page 81

 4. Click Close.
5. all changes.

7.1 Test Firewall Behavior Without Decryption

For this lab, you will use the Internet Explorer browser. Chrome has its own virus detection
system and Firefox has its own certificate repository.

6. Select Policies > Security.

7. Click application-default in the Service column in the egress-outside-content-id
Security policy rule.

8. In the Service window, change application-default to .

9. Click OK in the Service configuration window.
10. all changes.
11. On the Windows desktop, open a browser in private/incognito mode and browse to
http://www.eicar.org.
12. Click the DOWNLOAD ANTIMALWARE TESTFILE image in the upper-right
corner:

13. Click the Download link on the left of the web page:

14. Within the Download area at the bottom of the page, click either the eicar.com or the
eicar.com.txt file to download the file using the standard HTTP protocol and not the
SSL-encrypted HTTPS protocol. The firewall will not be able to detect the viruses in an
HTTPS connection until decryption is configured.

© 2018 Palo Alto Networks, Inc. Page 82

 You should get a block page.

15. Go back in the browser and download one of the test files using HTTPS:

16. Notice that the download is not blocked because the connection is encrypted and the virus
is hidden.
17. Close all browser windows except for the firewall web interface.

7.2 Create Two Self-Signed Certificates

You need to generate certificates so that the firewall can decrypt traffic.
18. In the web interface select Device > Certificate Management > Certificates:

19. Click at the bottom of the page to create a new CA certificate.

20. Configure the following:
Parameter Value
Certificate Name trusted-ca
Common Name 192.168.1.1
Certificate Authority

21. Click Generate to create the certificate.

22. Click OK to close the Generate Certificate success window.

23. Click at the bottom of the page to create another CA certificate.

24. Configure the following:

© 2018 Palo Alto Networks, Inc. Page 83

 Parameter Value
Certificate Name untrusted-ca
Common Name untrusted
Certificate Authority

25. Click Generate to create the certificate.

26. Click OK to close the Generate Certificate success window.
27. Click trusted-ca in the list of certificates to edit the certificate information.
28. Select the Forward Trust Certificate check box and click OK:

29. Click untrusted-ca in the list of certificates to edit the certificate information.
30. Select the Forward Untrust Certificate check box and click OK:

7.3 Create Custom Decryption URL Category

Create a custom URL Category to ensure that we are decrypting only intended traffic.

31. In the web interface select Objects > Custom Objects > URL Category.
32. Click to open the Custom URL Category configuration window.
33. Configure the following:
Parameter Value
Name lab-decryption

© 2018 Palo Alto Networks, Inc. Page 84

 Parameter Value
Sites

34. Click OK to close the Custom URL Category configuration window.

7.4 Create Decryption Policy

35. In the web interface select Policies > Decryption.
36. Click to create a Decryption policy rule.
37. Configure the following:
Parameter Value
Name decrypt-url-cat

38. Click the Source tab and configure the following:

Parameter Value
Source Zone inside

39. Click the Destination tab and configure the following:

Parameter Value
Destination Zone outside

40. Click the Service/URL Category tab and configure the following:
Parameter Value
URL Category

41. Click the Options tab and configure the following:

Parameter Value
Action

Type

© 2018 Palo Alto Networks, Inc. Page 85

 42. Click OK to close the Decryption Policy Rule configuration window.
43. all changes.

7.5 Test AV Security Profile with the Decryption Policy

44. On the Windows desktop, open an Internet Explorer browser window in private/incognito
mode and browse to http://www.eicar.org.
45. Click the DOWNLOAD ANTIMALWARE TESTFILE image in the upper-right
corner:

46. Click the Download link on the left of the web page:

47. Within the Download area at the bottom of the page, click either the eicar.com or the
eicar.com.txt file to download the file using HTTPS:

A certificate issue is presented:

Note: The endpoint (Windows desktop) does not trust the certificate generated by the
firewall.
48. Close all browser windows except for the firewall web interface.

© 2018 Palo Alto Networks, Inc. Page 86

7.6 Export the Firewall Certificate
49. In the web interface select Device > Certificate Management > Certificates.

50. Select but do not open trusted-ca.

51. Click to open the Export Certificate configuration window.

52. Click OK to export the trust-ca certificate.
53. You may see a warning saying this type of file can harm your computer. Click Keep.

7.7 Import the Firewall Certificate

54. On your desktop, double-click the certificates icon.

55. Under Certificates (Local Computer), expand Trusted Root Certification Authorities
and select the Certificates folder:

56. Select Action > All Tasks > Import.

57. The Certificate Import Wizard opens. Click Next.
58. Browse for the exported trusted-ca certificate, which might be presented as

or at This PC > Downloads:

59. Click Next.

60. Verify that the following is configured:

61. Click Next, click Finish, and then click OK in the status window.

© 2018 Palo Alto Networks, Inc. Page 87

 62. Notice that the trusted-ca certificate now is imported:

63. Close the Microsoft Management Console. Click No when asked to save console settings.

7.8 Test the Decryption Policy

64. On the Windows desktop, open an Internet Explorer browser window in private/incognito
mode and browse to http://www.eicar.org.
65. Click the DOWNLOAD ANTIMALWARE TESTFILE image in the upper-right
corner.

66. Click the Download link on the left of the web page.

67. Within the Download area at the bottom of the page, click either the eicar.com or the
eicar.com.txt file to download the file using HTTPS:

The Eicar Test File is detected and the connection gets reset.

© 2018 Palo Alto Networks, Inc. Page 88

 68. In the same browser, browse to https://www.paloaltonetworks.com. There is no
certificate warning and the page is displayed correctly.
69. Click the lock icon next to the URL in the browser (Internet Explorer).
70. Notice that the signer is the firewall 192.168.1.1:

71. Close all browser windows except for the firewall web interface.
72. Open a new browser and browse to https://www.badssl.com.
73. Click untrusted-root:

© 2018 Palo Alto Networks, Inc. Page 89

 Notice that a certificate warning is now displayed.
74. Choose to continue to the website.
75. Click the icon near the URL and then click View Certificates:

Notice that the certificate is still signed by the firewall. However, it was signed with the
untrusted certificate.

7.9 Review Logs

76. Select Monitor > Logs > Threat.
Notice that there is an entry for when the connection was reset in the browser:

© 2018 Palo Alto Networks, Inc. Page 90

 77. Select Monitor > Logs > Traffic.
78. Type ( flags has proxy ) in the filter text box. This filter flags only traffic entries
that were decrypted.

79. Hover the mouse over Receive Time and click the down-arrow.

80. Add the column.

Notice the newly added column:

7.10 Test URL Filtering with Decryption

81. In the web interface select Objects > Security Profiles > URL Filtering.
82. Click to open the lab-url-filtering object.
83. Click the Categories tab and type a search for tech-sites.
84. Change Site Access to block:

85. Click OK.

86. all changes.
87. Open an Internet Explorer browser window in private mode and browse to
https://engadget.com.
Engadget now is blocked because the site can be identified and blocked per the URL
Filtering Profile:

© 2018 Palo Alto Networks, Inc. Page 91

 Stop. This is the end of the Decryption lab.

© 2018 Palo Alto Networks, Inc. Page 92

8. Lab: WildFire

Lab Objectives
▪ Configure and test a WildFire Analysis Security Profile.

8.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

3. Select edu-210-lab-08 and click OK.

4. Click Close.
5. all changes.

© 2018 Palo Alto Networks, Inc. Page 93

8.1 Create a WildFire Analysis Profile
6. In the web interface select Objects > Security Profiles > WildFire Analysis.

7. Click to open the WildFire Analysis Profile configuration window.

8. Configure the following:
Parameter Value
Name lab-wildfire

9. Click and configure the following:

Parameter Value
Name pe
Applications any
File Types pe
Direction both
Analysis public-cloud

Note: The file type pe is a group that includes .exe, .cpl, .dll, .ocx, .sys, .scr, .drv, .efi,
.fon, and .pif file types.
10. Click OK to close the WildFire Analysis Profile configuration window.

8.2 Modify Security Profile Group

11. In the web interface select Objects > Security Profile Groups.
12. Click to open the lab-spg Security Profile Group.
13. Add the newly created lab-wildfire WildFire Analysis Profile:

© 2018 Palo Alto Networks, Inc. Page 94

 14. Click OK.
15. all changes.

8.3 Test the WildFire Analysis Profile

16. Open a new Chrome browser in private/incognito mode and browse to
http://wildfire.paloaltonetworks.com/publicapi/test/pe. This site
generates an attack file with a unique signature, which simulates a zero-day attack.
17. A wildfire-test-pe-file.exe automatically is downloaded to the Downloads directory. Do
not open the file.
18. To verify that the file was uploaded to the public WildFire® cloud, open PuTTY and
double-click firewall-management to log in to the firewall with admin/admin.
19. When you are logged in, enter the debug wildfire upload-log show command to
display the output log: 0, filename: wildfire-test-pe-file.exe
processed…. This output verifies that the file was uploaded to the WildFire® public
cloud. The message might take a minute or two to appear:

© 2018 Palo Alto Networks, Inc. Page 95

 20. Type exit to close the PuTTY session.
21. Select Monitor > Logs > WildFire Submissions. After five minutes have passed, find
the entry for wildfire-test-pe-file.exe that has been submitted to WildFire® and identified
as malicious.
22. Click the magnifying glass icon next to the entry to see the Detailed Log View of the
WildFire® entry:

23. On the Log Info tab, review the information within the General, Source, and
Destination panels.
24. Then look at the information in the WildFire Analysis Report tab. The verdict for this
file is Malware. Scroll down the Log Info tab to see Static and Dynamic Analysis,
Network Activity, Host Activity (by process), and Report Incorrect Verdict.

© 2018 Palo Alto Networks, Inc. Page 96

 Stop. This is the end of the WildFire® lab.

© 2018 Palo Alto Networks, Inc. Page 97

9. Lab: User-ID

Lab Objectives
▪ Enable User-ID technology on the inside zone.
▪ Configure the LDAP Server Profile to be used in group mapping.
▪ Configure group mapping for User-ID.
▪ Configure and test the PAN-OS® integrated User-ID agent.
▪ Leverage User-ID information in a Security policy rule.

9.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

3. Select edu-210-lab-09 and click OK.

4. Click Close.

© 2018 Palo Alto Networks, Inc. Page 98

 5. all changes.

9.1 Enable User-ID on the Inside Zone

6. In the web interface select Network > Zones.
7. Click to open the inside zone.
8. Enable User-ID by selecting the Enable User Identification check box:

9. Click OK.

9.2 Configure the LDAP Server Profile

Create a Server Profile so that the firewall can pull group and user information from Active
Directory.

10. In the web interface select Device > Server Profiles > LDAP.

11. Click and configure the following:

Parameter Value

Profile Name lab-active-directory

12. Locate the server list on the left side of the window and click .
13. Configure the following:
Parameter Value

Name active directory

LDAP Server 192.168.1.20

Port 389

14. Locate Server Settings on the right side of the window and configure the following:
Parameter Value

Require SSL/TLS Deselect the check box

secured connection (make sure to do this first)

Type active-directory

Base DN DC=lab,DC=local

© 2018 Palo Alto Networks, Inc. Page 99

 Parameter Value

Bind DN [email protected]

Password Pal0Alt0

15. Click OK to close the LDAP Server Profile configuration window.

9.3 Configure User-ID Group Mapping

Define which users and groups will be available when policy rules are created.
16. In the web interface select Device > User Identification > Group Mapping Settings.

17. Click to open the Group Mapping configuration window.

18. Configure the following on the Server Profile tab:
Parameter Value

Name lab-group-mapping

Server Profile lab-active-directory

(all other fields will autopopulate)

© 2018 Palo Alto Networks, Inc. Page 100

 19. Click the Group Include List tab and configure the following:
Parameter Value

Search box lab users

20. Click OK.

9.4 Configure Integrated Firewall Agent

21. Select Device > User Identification > User Mapping.
22. Click the icon in the upper-right corner of the Palo Alto Networks User-ID Agent
Setup pane.
23. Configure the following on the WMI Authentication tab:
Parameter Value

User Name lab\lab-user-id

Password Pal0Alt0

24. Click the Server Monitor tab and verify the following:
Parameter Value

Windows Server
Monitoring

25. Click the Client Probing tab.

26. Verify that the Enable Probing check box is deselected.
27. Click the Cache tab and configure the following:

© 2018 Palo Alto Networks, Inc. Page 101

 Parameter Value

Enable User
Identification Timeout

Note: Ensure that the timeout option is not enabled. You do not need to time out the IP
address associated with the lab-user-id because the IP never changes. In a production
environment, the timeout is recommended to be half the DHCP lease time.
28. Click the Ignore User List tab.
29. Click and configure the following:
Parameter Value

Ignore User

Prevents the firewall from assuming that Administrator is

associated with 192.168.1.20

30. Click OK.

31. Select Device > Setup > Management.
32. Verify that Domain is set to “lab.local” under General Settings
33. Select Device > Setup > Services.
34. Change the Primary DNS Server from “4.2.2.2” to the internal Active Directory
“192.168.1.20”

35. all changes.

36. Select Device > User Identification > User Mapping.
37. Scroll down to the Server Monitoring pane.
38. Click and verify that the labs internal Active Directory is discovered:

39. all changes.

9.5 Verify User-ID Configuration

40. Under the Server Monitoring section, the status should be Connected:

© 2018 Palo Alto Networks, Inc. Page 102

 41. On the Windows desktop, double-click the lab folder and then double-click the bat files
folder.

42. Double-click the user-id.bat file icon.

Note: This action will force a login event for the firewall to parse and is only required in
the lab environment.

43. On the Windows desktop, double-click the PuTTY icon.

44. Double-click firewall-management:

45. Log in to the firewall with admin/admin.

46. Type the CLI command show user group-mapping state all.
The output should be similar to the following:

47. Type the CLI command show user ip-user-mapping all.

The output should be similar to the following:

Note: lab\lab-user must have the IP address of 192.168.1.20. If that IP address is not
listed, do not proceed. Contact your instructor or lab partner for assistance.

© 2018 Palo Alto Networks, Inc. Page 103

 48. Open a browser and browse to shutterfly.com and google.com to generate some
traffic.

9.6 Review Logs

49. Select Monitor > Logs > Traffic.
50. Type the filter (addr.src in 192.168.1.20 ) in the filter text box.
51. Notice that the Source User column now shows the lab-user. Note: This User-ID

reference may take up to three minutes to show on the logs. Click refresh to update
the log entries:

9.7 Create Security Policy Rule

52. Select Policies > Security.

53. Click to open the Security Policy Rule configuration window.

54. Configure the following:
Parameter Value
Name egress-outside-user-id

55. Click the Source tab and configure the following:

Parameter Value
Source Zone

56. Click the User tab and configure the following:

Parameter Value
Source User

© 2018 Palo Alto Networks, Inc. Page 104

 Parameter Value
You may need to start typing before usernames become
available on the drop-down list.

57. Click the Destination tab and configure the following:

Parameter Value
Destination Zone

58. Click the Application tab and configure the following:

Parameter Value
Applications facebook-base

59. Click the Actions tab and configure the following:

Parameter Value
Action Deny

60. Click OK to close the Security Policy Rule configuration window.

61. Select but do not open the egress-outside-user-id Security policy rule.

62. Click and select .

63. You might need to adjust columns:

64. all changes.

9.8 Review Logs

65. Open a new Internet Explorer browser window in private/incognito mode and browse to
www.facebook.com.
The connection is denied based on the egress-outside-user-id Security policy rule:

© 2018 Palo Alto Networks, Inc. Page 105

 66. Select Monitor > Logs > Traffic.
67. Type the filter (rule eq ‘egress-outside-user-id’) in the filter text box.
68. Notice that the Source User column shows the lab-user and the Action is reset-both:

Stop. This is the end of the User-ID lab.

© 2018 Palo Alto Networks, Inc. Page 106

10. Lab: GlobalProtect

Lab Objectives
▪ Create and configure a subinterface.
▪ Create certificates for the GlobalProtect Portal, internal gateway, and external gateway.
▪ Attach certificates to an SSL-TLS Service Profile.
▪ Configure the Server Profile and Authentication Profile to be used when authenticating
users.
▪ Create and configure the tunnel interface to be used with the external gateway.
▪ Configure the internal gateway, external gateway, and portal.
▪ Host the GlobalProtect agent on the portal for download.
▪ Create a No-NAT policy rule to ensure that portal traffic is not subjected to network
address translation.
▪ Test the external gateway and internal gateway.

10.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

© 2018 Palo Alto Networks, Inc. Page 107

 3. Select edu-210-lab-10 and click OK.
4. Click Close.
5. all changes.

10.1 Configure a Subinterface

Subinterfaces enable logical interfaces to be associated with a physical interface. By default,
VLAN tags are required for subinterfaces. However, untagged interfaces can be used to isolate
traffic via zones on the same physical interface. A subinterface is created in the lab to provide
experience using a subinterface. Traffic will not be isolated using zones.
6. Select Network > Interfaces > Ethernet.
7. Click to open ethernet1/2.
8. Click the Advanced tab.

9. Select the Untagged Subinterface check box.

10. Click OK.

11. Verify that ethernet1/2 is still selected and click .

12. Configure the following:
Parameter Value
Interface
Name
Comment internal gateway
Virtual Router lab-vr
Security Zone inside

13. Click the IPv4 tab and configure the following:

Parameter Value
IP 192.168.2.1/24

14. Click the Advanced tab and select ping for the Management Profile.
15. Click OK.

© 2018 Palo Alto Networks, Inc. Page 108

10.2 Generate Self-Signed Certificates
GlobalProtect needs three certificates, one each for the portal, external gateway, and internal
gateway. These certificates typically are signed by a common CA certificate. This lab creates a
CA certificate and Internal Gateway certificate, but combines the Portal and External Gateway
certificates because these GlobalProtect functions are combined on the same IP address. The
common CA certificate will be exported and installed on the lab client to make all certificates
trusted.
16. In the web interface select Device > Certificate Management > Certificates.

17. Click and create a certificate:

Parameter Value
Certificate Name GlobalProtect
Common Name GlobalProtect
Signed By Leave blank
Certificate Authority Select the check box

18. Click .
19. Click OK to dismiss the successful status window.

20. Click and create another certificate:

Parameter Value
Certificate Name external-gw-portal
Common Name 203.0.113.20
Signed By GlobalProtect

21. Click .
22. Click OK to dismiss the successful status window.

23. Click and create another certificate:

Parameter Value
Certificate Name internal-gw
Common Name 192.168.2.1

© 2018 Palo Alto Networks, Inc. Page 109

 Parameter Value
Signed By GlobalProtect

24. Click .
25. Click OK to dismiss the successful status window.
26. Export the GlobalProtect certificate, select but do not open GlobalProtect.

27. Click to open the Export Certificate configuration window.

28. Click OK to export the GlobalProtect certificate.
29. You may see a warning saying this type of file can harm your computer. Click Keep.

30. Open the Windows Explorer, under the Downloads folder right-click the GlobalProtect
certificate and select Install Certificate
Note: The certificate file might have been saved with a .txt extension depending on what
browser you used to export it. In this case please remove the .txt file extension.

31. Click Open, in case of a security warning.

32. Select Local Machine as the Store Location and click Next

33. Click Yes if a User Account Control warning appears.

© 2018 Palo Alto Networks, Inc. Page 110

 34. Select Place all certificates in the following store, click browse and select the Trusted
Root Certification Authorities store

35. Click Next and then Finish to close the Certificate Import Wizard.
36. After a couple of seconds a window will pop-up confirming that the certificate was
installed successfully, click OK
37. Double-click the GlobalProtect certificate in the Windows Explorer and click Open. In
the Certificate Path tab notice the status at the bottom confirming that the certificate is now
trusted

10.3 Configure the SSL-TLS Service Profile

38. Select Device > Certificate Management > SSL/TLS Service Profile.

39. Click to create an SSL/TLS Service Profile:

Parameter Value
Name external-gw-portal
Certificate external-gw-portal
Min Version TLSv1.2

40. Click OK.

© 2018 Palo Alto Networks, Inc. Page 111

 41. Click to create an SSL/TLS Service Profile:
Parameter Value
Name internal-gw
Certificate internal-gw
Min Version TLSv1.2

42. Click OK.

10.4 Verify the LDAP Server Profile

Verify that the LDAP Server Profile is configured as follows.

43. In the web interface select Device > Server Profiles > LDAP.

44. Click and configure the following:

Parameter Value

Profile Name lab-active-directory

45. Locate the Server list on the left side of the window and click .
46. Configure the following:
Parameter Value

Name active directory

LDAP Server 192.168.1.20

Port 389

47. Locate Server settings on the right side of the window and configure the following:
Parameter Value

Type active-directory

Require SSL/TLS Deselect the check box

secured connection (Make sure to do this before proceeding)

Base DN DC=lab,DC=local

Bind DN [email protected]

Password Pal0Alt0

© 2018 Palo Alto Networks, Inc. Page 112

 48. Click OK to close the LDAP Server Profile configuration window.

10.5 Configure the Authentication Profile

49. Select Device > Authentication Profile.

50. Click and configure the following:

Parameter Value
Name auth-gp
Type LDAP
Server Profile lab-active-directory
User Domain lab

51. Click the Advanced tab.

52. Configure the following:
Parameter Value
Allow List all

53. Click OK.

10.6 Configure the Tunnel Interface

54. Select Network > Interfaces > Tunnel.

55. Click and create a new tunnel interface:

© 2018 Palo Alto Networks, Inc. Page 113

 Parameter Value
Interface
Name
Comment GlobalProtect
Virtual lab-vr
Router
Security inside
Zone

56. Click OK to close the Tunnel Interface configuration window.

10.7 Configure the Internal Gateway

Internal gateways are used for User-ID deployment and Host Information Profile (HIP)
enforcement.

57. In the web interface select Network > GlobalProtect > Gateways.

58. Click to create a gateway. The GlobalProtect Gateway Configuration window

opens.
59. Configure the following:
Parameter Value
Name gp-int-gateway
Interface ethernet1/2.2
IPv4 Address 192.168.2.1/24

60. Select the Authentication tab and configure the following:

Parameter Value
SSL/TLS Service Profile internal-gw

61. Locate the Client Authentication list box. Click and configure the following:
Parameter Value
Name lab-ad
OS Any

© 2018 Palo Alto Networks, Inc. Page 114

 Parameter Value
Authentication Profile auth-gp

62. Click OK to close the Client Authentication list box.

63. Click OK to close the GlobalProtect Gateway configuration window.

10.8 Configure the External Gateway

64. Click to create a gateway. The GlobalProtect Gateway configuration window
opens.
65. Configure the following:
Parameter Value
Name gp-ext-gateway
Interface ethernet1/1
IPv4 Address 203.0.113.20/24

66. Select the Authentication tab and configure the following:

Parameter Value
SSL/TLS Service Profile external-gw-portal

67. Locate the Client Authentication list box. Click and configure the following:
Parameter Value
Name lab-ad
OS Any
Authentication Profile auth-gp

68. Click OK.

69. Click the Agent tab and configure the following:
Parameter Value
Tunnel Mode Select the check box
Tunnel Interface tunnel.11
Enable IPSec Verify that the check box is selected

70. Click the Client Settings subtab.

71. Click and configure the following:

© 2018 Palo Alto Networks, Inc. Page 115

 Parameter Value
Name gp-client-config

72. Click the IP Pools tab and configure the following:

Parameter Value
IP Pool
Click and type 192.168.100.200-
192.168.100.210

73. Click OK to close the Configs window.

The GlobalProtect Gateway configuration window should still be open on the Client
Settings subtab.
74. Click the Network Services subtab and configure the following:
Parameter Value
Primary DNS 4.2.2.2
Secondary DNS 8.8.8.8

75. Click OK to close the GlobalProtect Gateway configuration window.

10.9 Configure the Portal

The GlobalProtect Portal provides the management functions for the GlobalProtect
infrastructure. Every endpoint that participates in the GlobalProtect network receives its
configuration from the portal, including information about the available GlobalProtect gateways
and any client certificates that might be necessary for the client to connect to a gateway.

76. Select Network > GlobalProtect > Portals.

77. Click to create a portal. The GlobalProtect Portal configuration window opens.
78. Configure the following:
Parameter Value
Name gp-portal
Interface ethernet1/1
IPv4 Address 203.0.113.20/24

79. Click the Authentication tab and configure the following:

© 2018 Palo Alto Networks, Inc. Page 116

 Parameter Value
SSL/TLS Service Profile external-gw-portal

80. Locate the Client Authentication list box. Click and configure the following:
Parameter Value
Name lab-ad
OS Any
Authentication Profile auth-gp

81. Click OK to close the Client Authentication list box.

82. Click the Agent tab.

83. Locate the Agent list box and click to open the Configs window and configure
the following:
Parameter Value
Name portal-agent-config

84. Click the Internal tab.

85. Select the Internal Host Detection IPv4 check box.
86. Configure the following:
Parameter Value
IP Address 192.168.2.1
Hostname gp-int-gw.lab.local

87. Locate the Internal Gateways list box and click to open the Internal Gateway
configuration window.
88. Configure the following:
Parameter Value
Name int-gw-1
Address IP
IPv4 192.168.2.1

89. Click OK to close the Internal Gateway configuration window.

90. Click the External tab.

© 2018 Palo Alto Networks, Inc. Page 117

 91. Locate the External Gateways list box and click to open the External Gateway
configuration window.
92. Configure the following:
Parameter Value
Name ext-gw-1
Address IP
IPv4 203.0.113.20

93. Locate the Source Region list box and click to configure the following:
Parameter Value
Source Region Any
Priority Highest

94. Click OK three times to close the External Gateway, Configs, and GlobalProtect
Portal configuration windows.

10.10 Host the GlobalProtect Agent on the Portal

95. In the web interface select Device > GlobalProtect Client.

96. Click Check Now at the bottom of the page. The Palo Alto Networks
firewall checks for the latest version of the GlobalProtect agent.
97. Search for 4.1.1 version of GlobalProtect.

98. Click the Download action next to version 4.1.1.

99. Click Activate for the GlobalProtect agent that you have just downloaded:

10.11 Create Security Policy Rule

100. Select Policies > Security.
101. Select the egress-outside Security policy rule without opening it.

102. Click . The Clone configuration window opens.

103. Verify that Move top is selected from the Rule order drop-down list.

© 2018 Palo Alto Networks, Inc. Page 118

 104. Click OK to close the Clone configuration window.
105. Click to open the cloned Security policy rule named egress-outside-1.
106. Configure the following:
Parameter Value
Name inside-portal
Tags internal

107. Click the Destination tab and configure the following:

Parameter Value
Destination Address 203.0.113.20

108. Click the Service/URL Category tab and configure the following:
Parameter Value
Service

109. Click OK to close the Security Policy Rule configuration window.

10.12 Create a No-NAT Rule

All traffic from the inside zone to the outside zone uses source NAT. You will create a new
NAT policy rule so that internal requests for the GlobalProtect Portal will not get their
address translated by the source-egress-outside rule. The new NAT policy rule must be
matched before the source-egress-outside rule.
110. Select Policies > NAT.
111. Click to define a new source NAT policy rule.
112. Configure the following:
Parameter Value
Name gp-portal-no-nat
Tags internal

113. Click the Original Packet tab and configure the following:
Parameter Value
Source Zone inside
Destination Zone outside
Destination Interface ethernet1/1

© 2018 Palo Alto Networks, Inc. Page 119

 Parameter Value
Destination Address 203.0.113.20

114. Click OK to close the NAT Policy Rule configuration window.

115. Select but do not open the gp-portal-no-nat NAT Policy rule.

116. Click and select .

117. all changes.
Note: A warning might appear about IPv6. You can safely ignore it.

10.13 Download the GlobalProtect Agent

118. Open a new browser window in private/incognito mode and browse to
https://203.0.113.20. Proceed past the certificate error.
The GlobalProtect Portal login page is presented:

119. Log in with the following:

Parameter Value
Name lab-user
Password Pal0Alt0

120. Download the Windows 64-bit MSI install file and use it to install the 64-bit
GlobalProtect agent:

© 2018 Palo Alto Networks, Inc. Page 120

10.14 Connect to the External Gateway
121. Enter the Portal address in the GlobalProtect pop-up window, and then click Connect:
Parameter Value
Portal 203.0.113.20

Note: The GlobalProtect agent may take a minute or two to open.

122. Enter the Username and Password in the GlobalProtect pop-up window, and then click
Sign In:
Parameter Value
Name lab-user
Password Pal0Alt0

© 2018 Palo Alto Networks, Inc. Page 121

 123. After a moment the status should update to Connected and the system tray icon should

update to .

Note: You might get disconnected from your lab-client, should this occur press CTRL
+ ALT + Shift simultaneously on your keyboard, click on your username on the top
and select Disconnect. Click Reconnect to reestablish the connection to your lab client

124. Right-click the GlobalProtect system tray icon to open the GlobalProtect pop-up

window, click the icon and then Settings.

125. Click the Connection tab and notice that the gateway is listed as ext-gw-1, the gateway
type is External, and a tunnel is established.

126. Notice that the IP assigned is the first in the IP pool specified on the external gateway:

© 2018 Palo Alto Networks, Inc. Page 122

10.15 View User-ID Information

127. On the Windows desktop, double-click the PuTTY icon.

128. Double-click firewall-management and log in to the firewall with admin/admin.
129. Type the command show user ip-user-mapping all.
The IP addresses for lab-user have been updated to include the tunnel IP address. Notice that
the From column lists GP (GlobalProtect):

130. Type exit to close the PuTTY session.

10.16 Disconnect the Connected User

131. In the web interface select Network > GlobalProtect > Gateways.
132. Click to the far right of the gp-ext-gateway:

133. Click to disconnect the lab-user:

134. Click Close.

135. Right-click the GlobalProtect agent in the Windows desktop system tray, click the
icon and select Disable:

© 2018 Palo Alto Networks, Inc. Page 123

10.17 Configure DNS Proxy
DNS servers perform the service of resolving a domain name to an IP address and vice versa.
When you configure the firewall as a DNS proxy, the firewall acts as an intermediary between
DNS clients and DNS servers, and as a DNS server by resolving queries from its DNS cache or
forwarding queries to other DNS servers. Configuration of the firewall to be a DNS proxy is
required so that GlobalProtect internal host detection works correctly.

136. In the web interface select Network > DNS Proxy.

137. Click to open the DNS Proxy configuration window.

138. Configure the following:
Parameter Value
Name gp-dns-proxy
Interface
ethernet1/2
Primary 4.2.2.2
Secondary 8.8.8.8

139. Under the DNS Proxy Rules tab click and configure the following:
This will redirect all DNS queries for the local Active Directory Domain to the domain
controller
Parameter Value
Name Local Domain
Domain Name
lab.local

*.lab.local
Primary 192.168.1.20

140. Click the Static Entries tab.

141. Click and configure the following:

Parameter Value
Name Internal Host Detection
FQDN gp-int-gw.lab.local
Address 192.168.2.1

© 2018 Palo Alto Networks, Inc. Page 124

 142. Click OK twice.
143. all changes.
144. On the Windows desktop, double-click the lab folder and then the bat files folder.
145. Right-click the set-dns-proxy.bat batch file and select Run as administrator.

146. On the Windows desktop, right-click the CMD icon and select Run as
administrator.
147. Type the command ipconfig /all.
148. Verify that the current DNS server is 192.168.1.1:

Note: Do not continue if the DNS server is otherwise. Contact the instructor.

10.18 Connect to the Internal Gateway

149. Right-click the GlobalProtect agent in the Windows desktop system tray and select

Enable. The system tray icon should update to .

150. On the GlobalProtect pop-up window, click the icon and then Settings. Click the
Connection tab in the GlobalProtect window and notice that the gateway is listed as
int-gw-1, the gateway type is Internal, and a tunnel is not established:

10.19 Reset DNS

151. On the Windows desktop, double-click the lab folder and then the bat files folder.
152. Right-click the remove-dns-proxy.bat batch file and select Run as administrator.
153. Use the Windows tools to uninstall the GlobalProtect Agent.

© 2018 Palo Alto Networks, Inc. Page 125

 154. On the Windows desktop, right-click the CMD icon, and select Run as
administrator.
155. Type the command ipconfig /all.
156. Verify that the current DNS server is 127.0.0.1:

Note: Do not continue if the DNS server is otherwise. Contact the instructor.

Stop. This is the end of the GlobalProtect lab.

© 2018 Palo Alto Networks, Inc. Page 126

11. Lab: Site-to-Site VPN

Lab Objectives
▪ Create and configure a tunnel interface to use in the site-to-site VPN connection.
▪ Configure the IKE gateway and IKE Crypto Profile.
▪ Configure the IPSec Crypto Profile and IPsec tunnel.
▪ Test connectivity.

11.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

3. Select edu-210-lab-11 and click OK.

4. Click Close.
5. all changes.

© 2018 Palo Alto Networks, Inc. Page 127

11.1 Configure the Tunnel Interface
6. In the web interface select Network > Interfaces.

7. Click the Tunnel tab.

8. Click to configure a tunnel interface:

Parameter Value

Interface Name In the text box to the right of tunnel, enter 12

Comment Tunnel to DMZ

Virtual Router lab-vr

Security Zone Create and assign a new Layer 3 zone named VPN

9. Click the IPv4 tab and configure the following:

Parameter Value

IP 172.16.3.1/30

10. Click the Advanced tab and configure the following:

Parameter Value

Management Profile ping

11. Click OK to close the Tunnel Interface configuration window.

11.2 Configure the IKE Gateway

12. Select Network > Network Profiles > IKE Gateways.

13. Click to create the IKE gateway and configure the following:
Parameter Value
Name dmz-ike-gateway
Version IKEv1 only mode
Interface ethernet1/3

© 2018 Palo Alto Networks, Inc. Page 128

 Parameter Value
Local IP Address Select 192.168.50.1/24
Peer IP Address Type IP
Peer IP Address 192.168.50.10
Pre-shared Key paloalto

14. Click the Advanced Options tab.

15. On the IKEv1 subtab configure the following:
Parameter Value
IKE Crypto Profile
Select

16. Configure the following:

Parameter Value
Name AES256-DH2-SHA2
DH Group Add Group 2
Authentication Add sha256
Encryption Add aes-256-cbc

17. Click OK twice to close the IKE Crypto Profile and the IKE Gateway window.

11.3 Create an IPSec Crypto Profile

18. In the web interface select Network > Network Profiles > IPSec Crypto.

19. Click to open the IPSec Crypto Profile configuration window.

20. Configure the following:
Parameter Value
Name AES256-DH2-SHA256
IPSec Protocol ESP
Encryption Add aes-256-cbc
Authentication Add sha256
DH Groups Select group2

21. Click OK to close the IPSec Crypto Profile configuration window.

© 2018 Palo Alto Networks, Inc. Page 129

11.4 Configure the IPsec Tunnel
22. In the web interface select Network > IPSec Tunnels.

23. Click to define the IPsec tunnel.

24. On the General tab:
Parameter Value
Name dmz-tunnel
Tunnel Interface tunnel.12
Type Auto Key
IKE Gateway dmz-ike-gateway
IPSec Crypto Profile AES256-DH2-SHA256
25. Click the Proxy IDs tab.
26. Click Add and configure the following:
Parameter Value
Proxy ID dmz—tunnel-network
Local 192.168.1.0/24
Remote 172.16.2.0/24

27. Click OK twice to close the Proxy IDs and IPsec Tunnel windows:

11.5 Add a Static Route for the VPN

28. Select Network > Virtual Routers.
29. Click to open the lab-vr virtual router.
30. Click the Static Routes vertical tab:

© 2018 Palo Alto Networks, Inc. Page 130

 31. Click to configure the following static route:.
Parameter Value
Name dmz-vpn
Destination 172.16.2.0/24
Interface tunnel.12
Next Hop none

32. Click OK to add the static route and then click OK again to close the Virtual Router –
lab-vr configuration window.

11.6 Create Security Policy Rule

33. Select Policies > Security.
34. Select the egress-outside Security policy rule without opening it.

35. Click . The Clone configuration window opens.

36. Verify that Move top is selected from the Rule order drop-down list.
37. Click OK to close the Clone configuration window.
38. Click to open the cloned Security policy rule named egress-outside-1.
39. Configure the following:
Parameter Value
Name dmz-vpn-tunnel
Tags internal

40. Click the Destination tab and configure the following:

Parameter Value
Destination Zone VPN

41. Click the Service/URL Category tab and configure the following:
Parameter Value
Service

42. Click OK to close the Security Policy Rule configuration window.

43. all changes.

© 2018 Palo Alto Networks, Inc. Page 131

11.7 Test Connectivity
44. Select Network > IPSec Tunnels.
Notice that the Status column indicator on the VPN tunnel might be red. If the Status shows
red, the VPN tunnel is not connected.

45. Refresh the Network > IPSec Tunnels page. The Status column indicator is now
green showing the VPN tunnel as connected:

46. Select Monitor > Logs > System.

47. Review the VPN log entries:

48. On the Windows desktop, double-click the Command Prompt icon.

49. Type the command ping 172.16.2.11.
50. Verify that the IP behind the VPN tunnel is responding:

51. On the Windows desktop, launch PuTTY, double-click firewall-management, and log
in to the firewall with admin/admin.
52. After the VPN tunnel is connected, type the following CLI commands and observe the
output:
show vpn ike-sa

© 2018 Palo Alto Networks, Inc. Page 132

 show vpn ipsec-sa tunnel dmz-tunnel:dmz-tunnel-network
show vpn flow name dmz-tunnel:dmz-tunnel-network
show running tunnel flow

Stop. This is the end of the Site-to-Site VPN lab.

© 2018 Palo Alto Networks, Inc. Page 133

12. Lab: Monitoring and Reporting
Lab Objectives
▪ Explore the Session Browser, App-Scope, and Application Command Center (ACC).
▪ Investigate traffic via the ACC and logs.
▪ Generate a User Activity report.
▪ Create a Custom report.
▪ Create a Report Group.
▪ Configure an email schedule.

12.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

3. Select edu-210-lab-12 and click OK.

4. Click Close.
5. all changes.

12.1 Generate Traffic

Note: The metrics displayed in the lab screenshots and the metrics displayed on your lab firewall
might be different.
Pre-populate the firewall with log entries and usernames that you can observe and investigate in
this lab.
6. On the Windows desktop, open PuTTY and double-click traffic-generator.
7. Enter the following information when prompted:
Parameter Value
Password Pal0Alt0

8. In the PuTTY window, type the command sh /tg/traffic.sh.

Note: After you execute the command, wait until the script finishes before proceeding to
the next step.

© 2018 Palo Alto Networks, Inc. Page 134

12.2 Explore the Session Browser
The Session Browser enables you to browse and filter current running sessions on the firewall.

9. Select Monitor > Session Browser to see any current sessions. You
might be able to see simulated sessions from the generated traffic. Notice that there is no
Source User column.
10. Click the icon at the upper-right of the window to open the Filters pane.
11. Type lab\jamie in the From User field.

12. Click .
13. Notice that, even though there is no Source User column, you still can search for the
From User. (Note: You also can search for a To User.)
14. Note: If a search for the user lab\jamie does not produce results, the session most
likely has completed and you will need to rerun the traffic generator on Step 8:

15. Locate a salesforce-base entry and click the Plus icon on the left to expand the display.
Notice the three sections labeled Detail, Flow 1, and Flow 2.
16. The Detail section shows various items of information. Your information may look
different. Important items that can help when troubleshooting are Session ID,
Application, Security Rule, QoS Rule, and QoS Class:

© 2018 Palo Alto Networks, Inc. Page 135

 Notice c2s (client to server) and s2c (server to client) in Flow 1 and Flow 2:

These flows provide information about both the request and response traffic.
17. You can end an active session by clicking the X icon at the far right of a session row:

12.3 Explore App Scope

With the App Scope reports, you can quickly see if any behavior is unusual or unexpected, which
helps you to identify problematic behavior. Each report provides a dynamic, user-customizable
window into the network. Long-term trends are difficult to represent in a lab environment.
However, knowing where to look is key to finding potential issues.

18. Select Monitor > App Scope > Summary.

The Summary report displays charts for the top five gainers, losers, bandwidth-
consuming Apps, bandwidth-consuming source, App categories, and threats.
19. Select Monitor > App Scope > Change Monitor.
The Change Monitor report displays changes over a specified time period. For example,
the following figure displays the top applications that gained in use over the last hour as
compared with the last 24-hour period. The top applications are determined by session
count and are sorted by percentage.

© 2018 Palo Alto Networks, Inc. Page 136

 20. The type of information displayed can be controlled at the top. The displayed graph can
be exported as a PDF or PNG:

21. You can change the time period at the bottom of the screen:

22. Select Monitor > App Scope > Threat Monitor.

The Threat Monitor report displays a count of the top threats over the selected time
period. By default, the figure shows the top 10 threat types for the past six hours.
23. You can filter the type of threat at the top of the screen:

24. The time period (shown at the bottom of the screen) can be changed to the Last 6 hours,
12 hours, 24 hours, 7 days, or 30 days:

25. Select Monitor > App Scope > Threat Map.

The Threat Map report shows a geographical view of threats, including severity.
26. Click Last 30 Days at the bottom of the screen.
27. At the top of the screen, click Outgoing Threats. You now should see the geographical
locations with threats and their average risk level.

© 2018 Palo Alto Networks, Inc. Page 137

 28. Click a geographical location that has a dot showing the threats from the firewall (for
example, Malaysia).

The ACC opens with a global filter referencing Malaysia (MY) or the geographical location
you clicked:

29. Click to clear the Global Filters.

30. Select Monitor > App Scope > Network Monitor.
The Network Monitor report displays the bandwidth dedicated to different network
functions over the specified period of time. Each network function is color-coded, as
indicated in the legend below the chart. For example, the following diagram shows
application bandwidth for the past six hours based on session information.

31. Click the icon to display the information by Session Count and not Bytes:

© 2018 Palo Alto Networks, Inc. Page 138

 Note: As is standard in all App Scope graph items, you can click an application color to
switch your view in the web interface to the ACC tab.
32. Select Monitor > App Scope > Traffic Map.
33. Change the view to show the Last 7 days by clicking the option at the bottom of the
screen and Outgoing Traffic at the top of the screen.
The Traffic Map report shows a geographical view of traffic flows according to sessions
or flows:

© 2018 Palo Alto Networks, Inc. Page 139

12.4 Explore the ACC
The ACC is an analytical tool that provides useful intelligence about the activity within your
network. The ACC uses the firewall logs to graphically depict traffic trends on your network.

34. Click the ACC tab.

35. Click the Time drop-down list and select Last 7 Days:

36. Explore the information available on the Network Activity tab. This tab displays an
overview of traffic and user activity on your network. It focuses on the top applications
being used; the top users who generate traffic with detailed information about the bytes,
content, threats, or URLs accessed by the user; and the most used security rules against
which traffic matches occur:

Notice that in every pane you can display data by bytes, sessions, threats, content, URLs, and
users:

© 2018 Palo Alto Networks, Inc. Page 140

 37. Select the users option in the Application Usage widget.
Notice how the application use seems more consistent across all colors versus bytes:

This information indicates that one application does not supersede any other application in
overall use by users.
38. Select threats in the Application Usage widget:

Given the displayed information, what is the primary source of threats in this environment?
(Your results may differ from what is shown.)
39. Focus your attention on the User Activity widget. Which user consumed the most
bandwidth in the past seven days?

© 2018 Palo Alto Networks, Inc. Page 141

 The graph in the example shows that Jamie has consumed the most bandwidth. Your user
might be different.
40. Focus your attention on the bottom-right Rule Usage widget.
41. Select sessions. Which Security policy rule has been used the most?

The displayed information in the example shows that the most active rule based on
session count is egress-outside. Your results may differ.
42. Click the Threat Activity tab:

© 2018 Palo Alto Networks, Inc. Page 142

 This tab displays an overview of the threats on the network. It focuses on the top threats:
vulnerabilities, spyware, viruses, hosts visiting malicious domains or URLs, top
WildFire® submissions by file type and application, and applications that use non-
standard ports:

Notice that some informational entries might not be useful.

43. Create a global filter for only medium and critical severities.
Click the icon and go to Threat > Severity and add critical and medium to the
Global Filters:

Notice that the graph updates to display only critical and medium severities.

© 2018 Palo Alto Networks, Inc. Page 143

 44. Scroll down to the bottom right and notice the Rules Allowing Apps On NonStandard
Ports widget:

This pane is helpful for identifying rules that need to enforce the application-default service
setting.

12.5 Investigate Traffic

45. In the web interface select Monitor > Logs > Threat.
46. Type the filter (severity neq informational) into the log filter text box and press
Enter.
47. Locate an entry referencing the source user sally and see which threat type and filename
is associated with user sally:

48. Click the ACC tab.

49. Select the Network Activity tab, remove any global filters, and ensure that the Time
drop-down list is Last 7 Days:

© 2018 Palo Alto Networks, Inc. Page 144

 50. Move to the User Activity pane.
51. Use the left-arrow to promote sally to a Global Filter:

52. Ensure that sally was promoted to a Global Filter:

Notice that all window panes have updated to show only information based on sally:

Which traffic in the displayed information is associated with sally? In the example, sally
is shown to be associated only with SMTP traffic, which could indicate a possible
infection and lateral movement.
53. Scroll down and locate the Destination Regions pane.
Notice that this is an internal network, which could indicate that sally is using corporate
e-mail and not an external source, or that there might be a rogue SMTP relay:

© 2018 Palo Alto Networks, Inc. Page 145

 54. Scroll down to the Rule Usage pane. Notice that only one rule allowed this traffic. If this
were a production environment, inspection should be done to ensure that this rule is
operating effectively. For example, should the rule allow SMTP? If not, is this a rogue
SMTP relay?

55. Scroll to the upper-left Application Usage pane.

56. Click the Jump to Logs icon and select Traffic Log:

Notice that the web interface switched views to the Traffic log with a predefined filter.
57. Select the Detailed Log view icon. At the bottom of the Detailed Log view are the
associated threat entries:

58. Click the ACC tab.

59. On the User Activity pane, click the Jump to Logs icon and select the Unified Log:

© 2018 Palo Alto Networks, Inc. Page 146

 Notice that both Traffic and Threat logs now are in one unified display, which can help
correlation activities.

12.6 User Activity Report

The firewall can generate reports that summarize the activity of individual users or user groups.

60. Select Monitor > PDF Reports > User Activity Report.
61. Click to define a new user activity report:
Parameter Value
Name mark
Type User
Username / IP Address lab\mark
Time Period Last 7 days

62. Click Run Now.

63. Download and open the report when it finishes:

64. Browse through the report to get familiar with the presented information. You also can
include detailed browsing history that will include an approximate time a user spends on
a website (this information is not available when a group is specified instead of an
individual user).

12.7 Create a Custom Report

65. Select Monitor > Manage Custom Reports.
66. Click to define a new custom report:
Parameter Value
Name top-applications
Database Select Summary Databases > Traffic
Time Frame Last 7 Days
Sort By Sessions and Top 10
Group By Application and 10 Groups

© 2018 Palo Alto Networks, Inc. Page 147

 Parameter Value
Selected Columns

67. Click OK to save the Custom Report window.

68. Click the top-applications report to reopen the Custom Report window.
69. Click Run Now to generate the report. The report will appear in a new tab in the browser
window:

70. Close the top-applications tab containing the report.

71. On the Report Setting tab, create the following query using the Query Builder: (rule
eq egress-outside) and (addr.src in 192.168.1.20)

© 2018 Palo Alto Networks, Inc. Page 148

 72. Click Run Now to run the report again, this time with the query:

73. Click to save the report as a PDF. (You might need to disable your
browser’s popup blocker.)
74. Click OK to close the Custom Report window.

12.8 Create a Report Group

75. In the web interface select Monitor > PDF Reports > Report Groups.
76. Click to define a new Report Group:
Parameter Value
Name lab-report-group

© 2018 Palo Alto Networks, Inc. Page 149

 Parameter Value
Reports

77. Click OK.

12.9 Schedule Report Group Email

78. In the web interface select Monitor > PDF Reports > Email Scheduler.
79. Click to define a new email schedule:
Parameter Value
Name lab-email-schedule
Report Group lab-report-group
Recurrence Daily
Email Profile Select New Email Profile

80. The Email Server Profile window is now displayed. Configure lab-smtp-profile as
the name.
Parameter Value
Name lab-smtp
Email Display Palo Alto Networks EDU Admin
Name
From [email protected]
To <your e-mail address>
Email Gateway 192.168.1.20

81. Click OK to close the Email Server Profile and Email Scheduler windows.

© 2018 Palo Alto Networks, Inc. Page 150

 82. Click . An error will be displayed indicating that the test email was not
send.
Note: For security reasons it is not possible to send E-Mails from the lab infrastructure.
83. Click OK to close the Email Scheduler window.

Stop. This is the end of the Monitoring and Reporting lab.

© 2018 Palo Alto Networks, Inc. Page 151

13. Lab: Active/Passive High Availability
This is a configuration lab only.

Lab Objectives
▪ Display the Dashboard HA widget.
▪ Configure a dedicated HA interface.
▪ Configure active/passive HA.
▪ Configure HA monitoring.
▪ Observe behavior in the HA widget.

13.0 Load Lab Configuration

1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

© 2018 Palo Alto Networks, Inc. Page 152

 3. Select edu-210-lab-13 and click OK.
4. Click Close.
5. all changes.

13.1 Display the HA Widget

If high availability (HA) is enabled, the High Availability widget on the Dashboard indicates
the HA status.
6. In the web interface click the Dashboard tab to display current firewall information.
7. If the High Availability panel is not displayed, select Widgets > System > High
Availability to enable the display:

The High Availability widget now displays on the Dashboard:

13.2 Configure the HA Interface

Each HA interface has a specific function: One interface is for configuration synchronization and
heartbeats, and the other interface is for state synchronization.
8. In the web interface select Network > Interfaces > Ethernet.
9. Click ethernet1/6 to open the configuration window for that interface.
10. Select HA on the Interface Type drop-down list, “HA1” as a comment and click OK:

11. Click ethernet1/7 to open the configuration window for that interface.
12. Select HA on the Interface Type drop-down list, “HA2” as a comment and click OK:

© 2018 Palo Alto Networks, Inc. Page 153

13.3 Configure Active/Passive HA
In this deployment, the active firewall continuously synchronizes its configuration and session
information with the passive firewall over two dedicated interfaces. If a hardware or software
disruption occurs on the active firewall, the passive firewall becomes active automatically
without loss of service. Active/passive HA deployments are supported by the interface modes
Virtual Wire, Layer 2, and Layer 3.
13. In the web interface select Device > High Availability > General.
14. Click the icon of the Setup panel to open the Setup configuration window.
15. Configure the following:
Parameter Value
Enable HA

Group ID 60 (This field is required, and must be unique, if multiple HA

pairs reside on the same broadcast domain.)
Mode Active Passive
Enable Config Sync
(Select this option to enable
synchronization of configuration settings between the peers.)
Peer HA1 IP Address 172.16.3.11
Backup Peer HA1 IP 192.168.1.253
Address

16. Click OK to close the Setup configuration window.

17. Click the icon of the Active/Passive Settings panel:

18. Select the Auto radio button. When Auto is selected, the links that have physical
connectivity remain physically up but in a disabled state. They do not participate in ARP
or packet forwarding. This configuration helps reduce convergence times during failover

© 2018 Palo Alto Networks, Inc. Page 154

 because no time is required to activate the links. To avoid network loops, do not select
this option if the firewall has any Layer 2 interfaces configured.

19. Click OK to close the Active/Passive Settings configuration window.

20. Click the icon of the Election Settings panel to configure failover behavior:
Parameter Value
Device Priority 80
Enter a priority value (range is 0–255) to identify the active
firewall. The firewall with the lower value (higher priority)
becomes the active firewall when the preemptive capability is
enabled on both firewalls in the pair.)
Preemptive

Enables the higher priority firewall to resume active operation

after recovering from a failure. This parameter must be
enabled on both firewalls but is not always a recommended
practice.
Heartbeat Backup

Uses the management ports on the HA firewalls to provide a

backup path for heartbeat and hello messages

21. Click OK to close the Election Settings configuration window.

22. Click the icon of the Control Link (HA1) panel to configure the HA1 link. The
firewalls in an HA pair use HA links to synchronize data and maintain state information:
Parameter Value
Port ethernet1/6
IPv4/IPv6 address 172.16.3.10

Netmask 255.255.255.0

© 2018 Palo Alto Networks, Inc. Page 155

 23. Click OK to close the Control Link (HA1) configuration window.
24. Click the icon of the Control Link (HA1 Backup) panel to configure the HA1
Backup link. Under Port select management.
25. Click OK to close the Control Link (HA1 Backup) configuration window.
26. Click the icon of the Data Link (HA2) panel to configure the HA2 data link. The
firewalls in an HA pair use HA2 data links to synchronize session information:
Parameter Value
Port ethernet1/7
Transport ethernet

HA2 Keep-alive

27. Click OK to close the Data Link (HA2) configuration window.

13.4 Configure HA Monitoring

28. In the web interface select Device > High Availability > Link and Path Monitoring.
29. Click the icon of the Link Monitoring panel to configure link failure detection. Link
monitoring enables failover to be triggered when a physical link or group of physical
links fails.
Parameter Value
Enabled

Failure Condition Any

30. Click OK to close the Link Monitoring configuration window.

31. Click in the Link Group panel to configure the traffic links to monitor:
Parameter Value

Name traffic-links
Enabled
(Note: Not supported on VM-Series on ESXi.)
Failure Condition Any
Interface ethernet1/1

© 2018 Palo Alto Networks, Inc. Page 156

 Parameter Value
ethernet1/2

32. Click OK to close the Link Group configuration window.

33. Click the icon of the Path Monitoring panel to configure Path Failure detection.
Path monitoring enables the firewall to monitor specified destination IP addresses by
sending ICMP ping messages to ensure that they are responsive.
Parameter Value

Enabled

Failure Condition Any

34. Click OK to close the Path Monitoring configuration window.

35. Find the Path Group panel and click Add Virtual Router Path to configure the path
failure condition:
Parameter Value

Name lab-vr
Enabled

Failure Condition All

Destination IP 8.8.8.8
8.8.4.4
9.9.9.9
Ping Interval 1000

36. Click OK to close the HA Path Group Virtual Router configuration window.
37. all changes.

13.5 Observe the Behavior of the HA Widget

38. In the web interface click the Dashboard tab and view the High Availability status
widget for the firewall. Active-passive mode should be enabled and the local firewall
should be active (green). You may need to refresh the High Availability pane if the local
firewall is still showing that it is initializing. However, because there is no peer firewall,
the status of most monitored items is unknown (yellow). Because HA1 has no peer, its
state is down (red):

© 2018 Palo Alto Networks, Inc. Page 157

 39. If a peer was configured and was operating in passive mode, the High Availability
widget on the Dashboard would appear as follows. To avoid overwriting the wrong
firewall configuration, the firewalls are not automatically synchronized. You must
manually synchronize a firewall to the firewall with the “valid” configuration by clicking
Sync to peer.

Stop. This is the end of the Active/Passive High Availability lab.

© 2018 Palo Alto Networks, Inc. Page 158

14. Lab: Capstone
This comprehensive lab is meant to provide you with additional hands-on firewall experience
and to enable you to test your new knowledge and skills. You can to refer to your student guide
and previous lab exercises.
In this scenario you are a network administrator and recently received a new Palo Alto Networks
VM-Series firewall. The firewall’s management IP address is 192.168.1.254. You can log in with
the default username and password. You also have been given permission to use your own
naming conventions for firewall objects such as Security zones, Security Profiles, Address
Groups, and Tags.
You are being asked to meet multiple configuration objectives. These objectives are listed in the
lab exercise sections that follow.

14.0 Load Lab Configuration

Reset your lab environment before you begin to work through the scenario.
1. In the web interface select Device > Setup > Operations.
2. Click Load named configuration snapshot:

© 2018 Palo Alto Networks, Inc. Page 159

 3. Select edu-210-lab-14 and click OK.
4. Click Close.
5. all changes.

14.1 Configure Interfaces and Zones

Complete the following objectives:
▪ Configure three firewall interfaces using the following values:
• Ethernet 1/1: 203.0.113.20/24 - Layer 3: Public network facing interface
• Ethernet 1/2: 192.168.1.1/24 - Layer 3: Internal network facing interface
• Ethernet 1/3: 192.168.50.1/24 – Layer 3: DMZ network facing interface
▪ Create Security zones for each network area of interest: DMZ, internal, and public. You
can name these zones whatever you like.
▪ Create a virtual router for all configured firewall interfaces.
▪ Create and assign an Interface Management Profile that enables 192.168.1.1 to respond to
ping requests.
▪ Create and assign unique tags to important zones.
You can consider this objective complete when the following tests are successful:
▪ Your internal host can ping 192.168.1.1
▪ From the firewall CLI the following commands are successful:
• ping source 203.0.113.20 host 203.0.113.1
• ping source 203.0.113.20 host 8.8.8.8
• ping source 192.168.1.1 host 192.168.1.10
• ping source 192.168.50.1 host 192.168.50.10

14.2 Configure Security and NAT Policy Rules

Create or modify the Security and NAT policy rules to address the following objectives:
Note: Optional tags can be helpful for identifying important rules.
▪ IP addresses 192.168.1.1 and 192.168.1.254 require access to the internet.
▪ A separate Security policy rule is required that allows the 192.168.1.0/24 network to
access the internet.
▪ Only the DMZ host 192.168.50.10 requires access to the internet.
▪ Facebook, Twitter, YouTube, 2600.org, and Reddit applications must be blocked for
users on the 192.168.1.0/24 network.

© 2018 Palo Alto Networks, Inc. Page 160

 ▪ The URL categories web-advertisements, phishing, malware, and unknown must be
blocked by a Security policy rule match criterion.
▪ Internal hosts 192.168.1.20 and 192.168.1.254 need to access the DMZ host for the
following applications: SSH, SSL, web-browsing, FTP, and ping. Access must be limited
to the applications’ default ports.
▪ Traffic matching the interzone default Security policy rule must log all traffic at session
end.
You can consider this objective complete when the following tests are successful:
▪ The internal host can ping 8.8.8.8 and google.com.
▪ The internal host cannot access twitter.com, youtube.com, reddit.com, and 2600.org.
▪ The internal host can access http://192.168.50.10/block-list.txt.
▪ The internal host can use FTP to access the DMZ host at 192.168.50.10 using the login
name lab-user and the password paloalto.
▪ The internal host can use SSH to access the DMZ host at 192.168.50.10 using the login
name lab-user and the password paloalto.
▪ The DMZ host can ping 8.8.8.8 and google.com.

14.3 Create and Apply Security Profiles

Create Security Profile Groups and apply them to the applicable Security policy rules to meet the
following objectives:
▪ A three-tiered URL filtering scheme is required:
• Tier 1: Allow access to only URL categories government, financial-services,
reference-and-research, and search-engines
• Tier 2: Allow access to only the URL category online-storage-and-backup
• Tier 3: Allow access to all URL categories
▪ The Tier 3 URL filtering must apply to the internal host.
▪ The Tier 2 URL filtering must apply to the DMZ host.
▪ The Tier 1 URL filtering must apply to the network 192.168.1.0/24.
Note: The Security policy rule specifically matching 192.168.1.20 must be evaluated before
the entire network segment.
▪ The Facebook, Twitter, YouTube, and Reddit applications must be blocked for everyone.
▪ All Security policy rules allowing internet access must leverage Antivirus, Anti-Spyware,
and Vulnerability Protection Profiles.
▪ The firewall must reset both the client and the server when a virus is detected in HTTP
traffic.
▪ The firewall must reset both the client and the server when medium-, high-, or critical-
level spyware is detected.

© 2018 Palo Alto Networks, Inc. Page 161

 ▪ The Anti-Spyware Security Profile must use the DNS Sinkhole feature for Palo Alto
Networks DNS Signatures and consult a custom External Dynamic List that references
http://192.168.50.10/dns-sinkhole.txt.
▪ The dns-sinkhole.txt file must contain the domain name phproxy.org.
▪ The firewall must reset both the client and server when high- or critical-level
vulnerabilities are detected.
▪ WildFire® analysis must be enabled on all Security policy rules that allow internet access.
The File Blocking feature must block PE file types and any multi-level-encoded files for
access between the internet and the 192.168.1.0/24 network segment.
You can consider this objective complete when the following tests are successful:
▪ Three URL Filtering configurations have been created and applied to the appropriate
Security policy rule(s).
▪ The DMZ host can ping box.net.
▪ The internal host can access box.net.
▪ The internal host cannot download an Eicar test virus using HTTP.
▪ A WildFire® test file gets reported to the WildFire® cloud when it is downloaded to the
internal host.
▪ A DNS request to phproxy.org initiated by an nslookup command on the internal host
results in a sinkhole event recorded in the Threat log.

14.4 Configure GlobalProtect

Configure GlobalProtect to meet the requirements listed in the following objectives:
▪ User access is provided through an external gateway.
▪ The GlobalProtect Portal and external gateway can authenticate users using either LDAP
or a local user group configured on the firewall.
▪ The external gateway provides an IP address pool in the range 172.16.5.200 to
172.16.5.250.
▪ The Tunnel interface must be assigned to a new and separate Security zone.
▪ A Security policy rule must allow internet access for hosts using the external gateway IP
pool.
▪ The external gateway requires the use of IPsec.
▪ One or more certificates are required for the portal and external gateway.
▪ Create a Security policy rule to allow the internal host access to the portal and external
gateway. This access might require the use of a no-NAT rule.

You can consider this objective complete when the following tests are successful:
▪ The internal host can successfully connect to the portal and external gateway.
▪ The internal host receives an IP pool address when connected to the external gateway.
▪ The internal host can access paloaltonetworks.com when connected to the external
gateway.

© 2018 Palo Alto Networks, Inc. Page 162

 Stop. This is the end of the Capstone lab.

© 2018 Palo Alto Networks, Inc. Page 163

The Palo Alto Networks Accredited Configuration Engineer assessment exam is a vendor
accreditation and not a formal certification exam. It should be attempted by anyone who has
completed the EDU-210 or EDU-110 course. The ACE assessment is based on the current PAN-
OS® release.
The ACE assessment tests your knowledge of the core features and functions of Palo Alto
Networks platform and next-generation firewalls, and serves as an objective indication of your
ability to configure Palo Alto Networks firewalls using PAN-OS® software. Passing the ACE
assessment indicates that you possess the basic knowledge to successfully configure a Palo Alto
Networks firewall. The exam also serves as a study aid to prepare for the formal Palo Alto
Networks Certified Network Security Engineer certification. Passing the ACE assessment also is
a requirement for those who want access to the Migration Tool.
The ACE assessment exam is free. You take it over the internet, using a common web browser.
Detailed information about ACE, including how to access it, is at
https://www.paloaltonetworks.com/services/education/ace.

© 2018 Palo Alto Networks, Inc. Page 164

The PCNSE is a formal certification that demonstrates that a candidate possesses an in-depth,
engineering-level knowledge of how to install, configure, and implement Palo Alto Networks
products. The PCNSE exam should be taken by anyone who wants to demonstrate a deep
understanding of Palo Alto Networks technologies. The exam can be attempted by anyone who
has completed either the EDU-210 or EDU-110 course, and the EDU-220 or EDU-120 course.
Completion of the courses is not a requirement for anyone attempting the PCNSE exam, but the
courses are helpful for acquiring the practical and theoretical knowledge necessary to pass the
exam. The PCNSE exam is based on the current major release of PAN-OS® software.
The PCNSE exam objectives are listed in the PCNSE exam blueprint. Your familiarity with
these objectives will help you to focus your study activities. A downloadable study guide also is
available to help you focus your study activities. There also is an online practice exam that you
can take. Links to the blueprint, study guide, practice exam, and other details about the PCNSE
exam are available at https://www.paloaltonetworks.com/services/education/pcnse.
After you have registered for, scheduled, and paid for the PCNSE exam, you take it at a certified
testing center. Register for and schedule your exam at
http://www.pearsonvue.com/paloaltonetworks.

© 2018 Palo Alto Networks, Inc. Page 165

The EDU-210 course is the starting point for all learning paths based on PAN-OS® software, and
various other courses build on that foundation.
In contrast, the endpoint-based learning paths are broken into two independent tracks: the on-
premise solution and the cloud-based solutions. The on-premise track comprises two courses, the
EDU-281 and the EDU-285. The cloud-based track comprises the EDU-290 course.
*The EDU-161 course can be taken at any time during the Distributed SOC Management
learning track. It does not have any formal prerequisites.

© 2018 Palo Alto Networks, Inc. Page 166

© 2018 Palo Alto Networks, Inc. PAN-EDU-210 8.1 Version A Page 167