Palo Alto Networks Administrator's Guide

Transcription

1 Palo Alto Networks /15/12??????? Palo Alto Networks????

2 Palo Alto Networks, Inc Palo Alto Networks. Palo Alto Networks PAN-OS Panorama Palo Alto Networks, Inc. P/N A

3 11 15, Palo Alto Networks Web Palo Alto Networks 3

4 Management Operations Services Content ID Session SNMP / PAN-OS PAN-OS PAN-OS RADIUS LDAP Kerberos Active Directory HIP SNMP Trap Palo Alto Networks

5 Netflow OCSP / HA / HA NAT HA HA Layer Layer Layer Layer Layer Layer Palo Alto Networks 5

6 VLAN HA VLAN DHCP DNS Proxy NAT NAT NAT NAT NAT DoS DoS Palo Alto Networks

7 URL DoS URL Palo Alto Networks 7

8 PDF Palo Alto Networks App-ID User Identification User Identification User-ID User-ID Agent PAN-OS Terminal Services Agent PAN-OS LDAP User Identification Agents PAN-OS PAN-OS User-ID Agent User-ID Agent User-ID Agent User-ID Agent User-ID Agent Terminal Services Agent Terminal Server Agent Terminal Server Agent Terminal Server Agent Palo Alto Networks

9 8 IPSec VPN IPSec IKE IPSec IKE Crypto IPSec VPN IKE IPSec IKE Crypto IPSec Crypto IPSec VPN VPN VPN GlobalProtect VPN VPN OCSP GlobalProtect GlobalProtect GlobalProtect Satellite VPN GlobalProtect GlobalProtect GlobalProtect GlobalProtect GlobalProtect GlobalProtect QoS QoS QoS QoS QoS Palo Alto Networks 9

10 11 VM VM VM Panorama Panorama Panorama Panorama M Panorama Panorama (HA) HA Panorama Panorama Web Panorama Panorama Panorama Panorama Panorama Panorama Palo Alto Networks

11 Panorama Panorama Panorama Panorama Panorama WildFire WildFire WildFire WildFire WildFire WildFire WildFire WildFire WildFire URL WEB URL Palo Alto Networks 11

12 SSL VPN SSL BSD GNU GNU MIT/X OpenSSH PSF PHP Zlib Palo Alto Networks

13 11 15, Palo Alto Networks Web Palo Alto Networks / IPSec IP (IPSec) Palo Alto Networks 13

14 9 GlobalProtect GlobalProtect GlobalProtect 10 (QoS) 12 Panorama Palo Alto Networks 13 Panorama Panorama 14 WildFire WildFire A HTML B Palo Alto Networks C D 14 Palo Alto Networks

15 courier 字型 Web (URL) Security Security Rules Palo Alto Networks set deviceconfig system dnssettings Devices Administrators Clone Rule Palo Alto Networks Palo Alto Networks 15

16 16 Palo Alto Networks

17 Palo Alto Networks TCP80 IPv4 IPv6 Palo Alto Networks 17

18 Secure Sockets Layer (SSL) (User-ID) User-ID Microsoft Active Directory edirectory SunOne OpenLDAP LDAP Web URL 185 URL Web (ACC) 215 GlobalProtect GlobalProtect 88 HA WildFire VM PAN-OS VMware ESXi x86 Palo Alto Networks Panorama Web (CLI) Panorama Web Web 18 Palo Alto Networks

19 27 Web HTTP HTTPS CLI Telnet Secure Shell (SSH) PAN-OS Panorama Web Palo Alto Networks Panorama Web Panorama 323 Panorama Panorama 333 Panorama (SNMP) RFC 1213 (MIB-II) RFC 2665 SNMP Trap 66 SNMP Trap 67 XML API Representational State Transfer (REST) API <firewall>/api <firewall> IP API DevCenter XML API Palo Alto Networks 19

20 20 Palo Alto Networks

21 Web 28 Panorama 323 Panorama App-ID 3. IP Palo Alto Networks 21

22 1. RJ-45 (MGT) IP Web Palo Alto Networks 4. admin 5. Device Setup 23 Web Management Interface Settings Management IP Services (DNS) IP (NTP) IP Palo Alto Networks 6. Devices Administrators 7. admin 8. New Password Confirm New Password IP Palo Alto Networks

23 Web Web Objects Device Palo Alto Networks 23

24 Web Task Manager Web Web [ ] Palo Alto Networks Devices Setup 24 Palo Alto Networks

25 Web Web Include Device and Network configuration Include Shared Object configuration Include Policy and Objects Palo Alto Networks 25

26 Web Include virtual system configuration 35 Operations Preview Changes Device > Config Audit 44 Vulnerability Protection Objects Security Profiles Vulnerability Protection Objects > Security Profiles > Vulnerability Protection 26 Palo Alto Networks

27 Web Web Config lock Commit Lock [ ] [ ] [ ] [ ] Device Setup Management Automatically acquire commit lock 30 Web Internet Explorer 7+ Firefox 3.6+ Safari 5+ Chrome 11+ Palo Alto Networks 27

28 Web Help / KnowledgePoint Palo Alto Networks

29 / PAN-OS SNMP Trap Netflow Palo Alto Networks 29

30 Management 35 Operations 38 Services 40 Content ID 41 Session 42 SNMP WildFire 367 WildFire Management Device > Setup > Management Setup WildFire IP Management Domain 31 (FQDN) 31 Name Password 30 Palo Alto Networks

31 1. Management Geo Location Automatically acquire commit lock # Failed Attempts PDF 233 PDF Web PDF 23 Web (YYYY/MM/ DD) 24 (HH:MM:SS) Device > Setup > Services NTP Panorama Setup Multi Virtual System Capability Web CLI Web CLI Palo Alto Networks 31

32 1. Management Panorama Panorama Server Panorama Palo Alto Networks IP Panorama Panorama Panorama Panorama Panorama Panorama Panorama Panorama 2 Receive Timeout for connection to Panorama Send Timeout for connection to Panorama Retry Count for SSL send to Panorama Panorama Panorama MGT Interface Speed MGT Interface IP Address (HA) Panorama HA Panorama Panorama TCP TCP Panorama Secure Sockets Layer (SSL) Panorama Panorama Panorama 10Mbps 100Mbps 1Gbps IP IP IP IP 32 Palo Alto Networks

33 1. Management MGT Interface IPv6 Address IPv6 MGT Interface Services Permitted IPs CSV Average Browse Time (sec) Page Load Threshold (sec) IPv6 IPv6 2001:400:f00::1/64 IPv6 IPv6 HTTP HTTPS Telnet Secure Shell (SSH) / ping IP 100% 100% CSV CSV Panorama 100 User Activity Report URL User Activity Report Palo Alto Networks 33

34 1. Management Stop Traffic when LogDb full DP Minimum Password Complexity (HA) Block Username Inclusion (including reversed) Block Password Change Period (days) Required Password Change Period (days) Expiration Warning Period (days) test2222 test Palo Alto Networks

35 1. Management Allowed expired admin login (count) Post Expiration Grace Period (days) Operations Device > Setup > Operations 2. Validate candidate config Revert to last saved config Revert to running config Save named configuration snapshot Save candidate config Load named configuration snapshot Load configuration version Export named configuration snapshot Export configuration version (running-config.xml) (running-config.xml) (running-config.xml) / Palo Alto Networks 35

36 2. Import named config snapshot VPN GlobalProtect CA XML API CLI save device state device_state_cfg.tgz /opt/pancfg/mgmt/ device-state scp export devicestate tftp export device-state XML API PAN-OS XML Rest API documentation 283 GlobalProtect VPN Reboot Device Shutdown Device Restart Data Plane Export device state Panorama Global Protect (CA) Reboot Device PAN-OS 35 Operations Web CLI request restart system PAN-OS Shutdown Device Web CLI request restart system PAN-OS Restart Dataplane PA-200 Web CLI request restart dataplanepan-os 36 Palo Alto Networks

37 2. SNMP UI PDF 233 PDF PDF png gif jpg 128 KB PDF PDF 233 PDF SNMP 42 SNMP 43 commit CLI Web CLI 27 Palo Alto Networks 37

38 Services Device > Setup > Services Services (DNS) (NTP) Proxy 3. Services DNS DNS Secondary DNS Server NTP NTP Proxy Proxy Proxy Proxy Confirm Secure Proxy Password DNS DNS FQDN DNS DNS Proxy DNS IP DNS DNS FDQN DNS IP NTP IP NTP NTP IP Palo Alto Networks IP updates.paloaltonetworks.com Proxy Palo Alto Networks IP Proxy Proxy Proxy 38 Palo Alto Networks

39 3. Services Service Route Configuration / DNSPalo Alto Networks NTP Use Management Interface for all (MGT) IP IP Palo Alto Networks IP/ Service Route Configuration Use Management Interface for all (MGT) MGT / MGT Device > Setup > Management Management Interface Settings Select [ ] IP Device > Setup > Services DNS DNS Destination Source Address Destination Source Address Kerberos LDAP Panorama IP RADIUS MGT Kerberos Service Route Configuration Destination Source Address Kerberos [] Ethernet1/3 IP Kerberos Ethernet1/3 Network > Virtual Routers Ethernet1/3 IP /24 CLI PA-200-Test# show route destination { { source address /24 } Ethernet1/ Palo Alto Networks 39

40 Content ID Device > Setup > Content-ID Content-ID URL 4. Content ID URL Dynamic URL Cache Timeout URL URL URL x-forwarded-for Strip-x-forwarded-for URL Settings for URL Admin Override URL URL BrightCloud URL URL 185 URL URL continue URL URL IP X-Forwarded-For HTTP X-Forwarded-For Proxy IP Src:x.x.x.x URL Source User x.x.x.x IP IP X-Forwarded-For IP WildFire VSYS VSYS URL Override 185 URL URL Location VSYS Password/Confirm Password Server Certificate SSL Mode Redirect IP 40 Palo Alto Networks

41 4. Content ID Manage Data Protection /pdf /soap+xml /xhtml+ /html / /xml URL Session Device > Setup > Session Session IPv6 5. Session ICMPv6 ICMPv6 Jumbo Frame Jumbo Frame MTU IPv6 NAT64 IPv6 MTU Telnet Deny Telnet ICMPv6 ICMPv ICMPv / 100 jumbo Jumbo MTU IPv6 IPv6 IPv6 IPv6 IPv6 MTU 1280 IPv6 MTU Palo Alto Networks 41

42 5. Session Enable OCSP (%) Accelerated Aging Threshold % Accelerated Aging Scaling Factor (CRL) SSL (CA) CRL SSL SSL (OCSP) SSL 173 CRL 1-60 OCSP SSL OCSP SNMP Device > Setup > Operations SNMPv2c SNMPv3 SNMP (MIB) Setup SNMP Setup MIB SNMP Trap SNMP Trap ID (OID) (varbind) 6. SNMP MIB 42 Palo Alto Networks

43 6. SNMP Use Specific Trap Definitions SNMP Trap OID SNMP V2c V3 MIB V2c public V2c SNMP Community String SNMP public V3 Views Name View OID (OID) Option OID Mask OID 0xf0 Users Users View Auth Password (SHA) Priv Password (AES) Device > Setup > Operations Palo Alto Networks Palo Alto Networks 4 URL Report Sample Palo Alto Networks 43

44 Device > Config Audit Config Audit 1. Panorama Panorama Device > Licenses Palo Alto Networks URL URL Licenses URL 44 Palo Alto Networks

45 / PAN-OS a. b. c. Web URL CLI PAN-OS / PAN-OS Device > Software PAN-OS Palo Alto Networks PAN- OS Software Palo Alto Networks PAN-OS PAN-OS PC Palo Alto Networks 45

46 / PAN-OS PAN-OS PAN-OS (HA)PAN-OS PAN-OS PAN-OS Decrypt failed:gnupg edit non-zero, with code Failed to load into PAN software manager. PAN-OS / / (HA) PAN-OS PAN-OS non-syn-tcp (HA) 82 HA Dashboard Widget Widget Widget > HA / // / / PAN-OS 2. Device > Setup > Operations Export named configuration snapshot running-config.xml 3. / B PAN-OS A / set session tcp-reject-non-syn no set session tcp-reject-non-syn yes / 4. / A / B PAN-OS B A 46 Palo Alto Networks

47 / PAN-OS 5. A PAN-OS A HA non-syn-tcp 3 set session tcp-reject-nonsyn yes 6. Monitor > Session Browser CLI show session all HA show high-availability all match reason / show high-availability interface ha2 CPU / / PAN-OS PAN-OS PAN-OS PAN-OS Device > Setup > Operations Export named configuration snapshot running-config.xml 2. Device > Software PAN- OS PAN-OS Palo Alto Networks 47

48 / PAN-OS PAN-OS Device > Setup > Operations Export named configuration snapshot running-config.xml 2. Device > Software PAN-OS 5.0 PAN-OS 4.1 autosave Palo Alto Networks

49 5. PAN-OS PAN-OS Device > Dynamic Updates Palo Alto Networks URL GlobalProtect WildFire WildFire Palo Alto Networks PC Dynamic Updates Local database RADIUS Remote Authentication Dial In User Service (RADIUS) LDAP (LDAP) Kerberos Kerberos Client Certificate RADIUS LDAP Kerberos DB Palo Alto Networks 49

50 SSL (VPN) 293 GlobalProtect PAN-OS Panorama PAN-OS SSL- VPN (`) < > (&) (*) (?) ( ) (\) (;) (") ($) '(' ')' (':') 50 Palo Alto Networks

51 7. (^) ([) (a-z) (A-Z) (0-9) (_) (.) (-) (]) (+) ($) Device > Admin Roles Admin Roles 53 FIPS CC admin paloalto admin admin / auditadmin cryptoadmin securityadmin Palo Alto Networks 51

52 8. Role WebUI CLI Web / CLI disable CLI superuser superreader deviceadmin devicereader Device > Password Profiles Minimum Password Complexity 34 Minimum Password Complexity 50 Device > Administrators 9. Required Password Change Period (days) Expiration Warning Period (days) Post Expiration Grace Period (days) Allowed expired admin login (count) Palo Alto Networks

53 Device > Administrators admin Password authentication Client certificate authentication (web) (SSH) / Setup > Management Minimum Password Complexity 10. Use only client certificate authentication (web) Confirm New Password (SSH) 15 RADIUS LDAP Kerberos DB 55 Web 15 Setup > Management Minimum Password SSH IETF SECSH OpenSSH DSA 1024 RSA Palo Alto Networks 53

54 10. Role Dynamic Superuser Superuser (read-only) Device Admin Device administrator (read-only) Vsys Admin Vsys Admin (read-only) Role Based Admin Panorama Administrators Device > Access Domain Access Domain RADIUS (VSA) RADIUS RADIUS 57 RADIUS RADIUS RADIUS RADIUS Panorama 343 Panorama [ ] 54 Palo Alto Networks

55 RADIUS LDAP Kerberos SSL-VPN SSL-VPN Setup 30 Management Setup RADIUS RADIUS Palo Alto Networks RADIUS Settings None Device > Authentication Profile Authentication Profile All Search Available any Palo Alto Networks 55

56 12. None Local Database RADIUS RADIUS LDAP LDAP Kerberos Kerberos RADIUS LDAP Kerberos Server 57 RADIUS 58 LDAP 59 Kerberos Active Directory LDAP LDAP LDAP Active Directory edirectory Sun ONE Directory SSL-VPN 293 GlobalProtect SSL-VPN <SCRIPT> function getpasswarnhtml(expdays) { var str = "Your password will expire in " + expdays + " days"; return str; } </SCRIPT> str Panorama Captive Portal User Group Authentication Profile Device > User Authentication > Captive Portal Captive Portal Authentication Profile Policies > Captive Portal Palo Alto Networks

57 Device > Local User Database > Users Local Users 13. Local User Name 31 Device > Local User Database > User Groups Shared Password Password Hash Local User Groups 14. Local User Group Name 31 Shared RADIUS Device > Server Profiles > RADIUS RADIUS RADIUS RADIUS 31 Shared RADIUS Palo Alto Networks 57

58 15. RADIUS Retrieve User Group RADIUS VSA Name IP address IP Port Secret/Confirm Secret RADIUS LDAP Device > Server Profiles > LDAP LDAP LDAP LDAP DN Bind Password/Confirm Bind Password SSL 31 Shared LDAP IP NetBIOS paloaltonetworks.com paloaltonetworks Palo Alto Networks SSL (TLS) LDAP Palo Alto Networks

59 Kerberos Active Directory Device > Server Profiles > Kerberos Internet Authentication Service (IAS) RADIUS Kerberos Active Directory Kerberos Kerberos Kerberos 55 Kerberos Kerberos 17. Kerberos 31 Shared 127 [email protected] example.local 31 Kerberos Server IP Host FQDN Port RADIUS LDAP Palo Alto Networks 59

60 Device > Authentication Sequence Authentication Sequence Monitor > Logs Panorama SNMP Trap 19. Configuration Data Filtering Alarms 75 Panorama SNMP Trap Palo Alto Networks

61 19. HIP URL Filtering WildFire HIP GlobalProtect (HIP) 293 GlobalProtect HA SNMP Trap / / 215 URL URL URL PAN-DB URL URL BrightCloud DB BrightCloud 185 URL WildFire WildFire [ ] [ ] [ ] [ ] [ ] [ ] WildFire WildFire WildFire 371 WildFire Palo Alto Networks 61

62 Panorama SNMP Trap 20. Panorama Panorama Panorama 30 Management SNMP Trap SNMP Trap SNMP Trap 66 SNMP Trap Syslog [ ] Device > Server Profiles > Syslog Custom Log Format HIP Device > Scheduled Log Export CSV (FTP) (SCP) FTP 3 FTP Scheduled Log Export SCP Test SCP server connection SCP SCP 21. Scheduled export start time (daily) url hipmatch 24 (hh:mm) (00:00-23:59) 62 Palo Alto Networks

63 21. Port FTP Username SCP FTP FTP IP FTP 21 FTP FTP anonymous FTP anonymous Device > Log Settings > Config Panorama / 22. Panorama Panorama SNMP Syslog SNMP Trap SNMP Trap 66 SNMP Trap Palo Alto Networks 63

64 Device > Log Settings > System Panorama SNMP Trap / HA 23. Panorama SNMP Syslog Panorama Panorama 30 Management Critical HA High RADIUS Medium Low Informational / SNMP / 66 SNMP Trap HIP Device > Log Settings > HIP Match (HIP) GlobalProtect HIP Panorama Panorama SNMP Syslog HIP SNMP Trap SNMP Trap 66 SNMP Trap 68 [ ] Device > Server Profiles > Syslog Custom Log Format HIP Palo Alto Networks

65 Device > Log Settings > Alarms Alarms 25. CLI Web Encryption/Decryption Failure Threshold CLI Web CLI / DB Selective Audit Security Violations Time Period IP Security Violations Threshold Alarms CC Specific Logging (CC) Verbose Login Success Logging Login Failure Logging Suppressed Administrators Device > Log Settings > Manage Logs Palo Alto Networks 65

66 SNMP Trap SNMP Trap Device > Server Profiles > SNMP Trap SNMP Trap SNMP Trap SNMP Trap V2c settings V3 settings SNMP 31 SNMP SNMP V2c Server SNMP Trap 31 Manager IP Community public V3 Server SNMP Trap 31 Manager IP User SNMP EngineID ID ID x ID MIB OID GET ID Auth Password (SHA) Priv Password (AES) 66 Palo Alto Networks

67 SNMP MIB SNMP MIB SNMPv2-MIB DISMAN-EVENT-MIB IF-MIB HOST-RESOURCES-MIB ENTITY-SENSOR-MIB PAN-COMMON-MIB PAN-TRAPS-MIB Palo Alto Networks Technical Documentation Enterprise MIB Device > Server Profiles > Syslog HIP Servers Server Port IP 514 Palo Alto Networks 67

68 27. Custom Log Format [ ] [ ] 68 Escaped characters [ ] Device > Server Profiles > Syslog Custom Log Format HIP 28. actionflags admin after-change-detail before-change-detail formtted-receive_time cef-formatted-time_generated client cmd host path receive_time result seqno serial subtype Panorama PAN-OS CEF CEF Web CLI add clone commit delete edit move rename set validate IP 512 [ ] [ ] [ ] [ ] 64 PAN-OS Palo Alto Networks

69 28. time_generated vsys [] [] [] [] [hip ] 29. actionflags cef-formatted-receive_time cef-formatted-time_generated eventid fmt module number-of-severity Panorama PAN-OS CEF CEF 512 [ ] [ ] [ ] [ ] [ ] [ ] [ ] opaque 512 receive_time seqno 64 PAN-OS serial severity [ ] [ ] [ ] [ ] [ ] subtype time_generated vsys crypto dhcp dnsproxy dos general global-protect ha hw nat ntpd pbf port pppoe ras routing satd sslmgr sslvpn userid url-filtering vpn [] [] [] [] [hip ] Palo Alto Networks 69

70 30. action actionflags app category cef-formatted-receive_time cef-formatted-time_generated contenttype direction dport dst dstloc dstuser flags from inbound_if logset misc natdport natdst natsport natsrc number-of-severity outbound_if proto receive_time repeatcnt [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ url] [ ] Panorama PAN-OS URL URL WildFire any CEF CEF HTTP 32 URL PAN-OS 'client-to-server' 'server-to-client' IP 32 PAN-OS [ ] URL URI wildfire 4.0 PAN-OS NAT NAT NAT IP NAT NAT NAT IP IP 5 IP IP ID URL 70 Palo Alto Networks

71 30. rule seqno serial sessionid severity sport src srcloc srcuser subtype threatid time_generated time_received to vsys Wildfire 64 PAN-OS [] [ ] [ ] [ ] [] IP 32 PAN-OS [URL] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [wildfire] Palo Alto Networks PAN-OS [] [] [] [] [hip ] WildFire 31. action [ ] [ ] [ ] actionflags Panorama PAN-OS app bytes bytes_received bytes_sent category cef-formatted-receive_time cef-formatted-time_generated PA-4000 PAN-OS PA-4000 PAN-OS URL CEF CEF Palo Alto Networks 71

72 31. dport dst dstloc dstuser elapsed flags from inbound_if logset natdport natdst natsport natsrc outbound_if packets pkts_received pkts_sent proto receive_time repeatcnt rule seqno serial sessionid sport src srcloc srcuser start IP 32 PAN-OS [ ] AND NAT NAT NAT IP NAT NAT NAT IP PA-4000 PAN-OS PA-4000 PAN-OS IP 5 IP IP ICMP 64 PAN-OS IP 32 PAN-OS Palo Alto Networks

73 31. subtype time_generated time_received to vsys [ ] [ ] [ ] [ ] [ ] [] [] [] [] [hip ] 32. HIP actionflags cef-formatted-receive_time cef-formatted-time_generated machinename matchname matchtype receive_time repeatcnt seqno serial src srcuser subtype time_generated vsys Panorama PAN-OS CEF CEF HIP HIP HIP HIP HIP 64 PAN-OS IP HIP [] [] [] [] [hip ] HIP Palo Alto Networks 73

74 Device > Server Profiles > Servers Server Custom Log Format SMTP From From (SMTP) IP [ ] 74 Palo Alto Networks

75 [ ] Web [ ] Device > Log Settings > Alarms > Alarm Settings Enable Alarms [ ] Netflow Device > Server Profiles > Netflow IP NetFlow 9 NetFlow IPv4 IPv4 NAT IPv6 App-ID User-ID PAN-OS PA NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow Netflow PAN-OS Server Port Netflow 31 Netflow PAN-OS Netflow App-ID User-ID 31 IP Palo Alto Networks 75

76 Device > Certificate Management > Certificates Certificates Forward Trust CA CA Certificates Forward Untrust CA CA Trusted Root CA CA CA CA CA CA CA SSL Exclude SSL Certificate for Secure Web GUI Web Web Certificates a. b. a. b. 76 Palo Alto Networks

77 Web CA SSL a. b. c. PKCS #12 PEM d. PKCS #12 PEM *.key e. a. b. c. PKCS#12.pfx.pem d. Export Private Key a. [ ] b. Forward Trust Forward Untrust Trusted Root CA SSL Exclude Certificate for Secure Web GUI Panorama Panorama Panorama 333 Panorama (HA) HA HA HA HA IP FQDN Shared CA Palo Alto Networks 77

78 35. OCSP Expiration (days) Locality Organization Department CA OSCP Device > Certificate Management > OCSP Responder OCSP IP OCSP URL 365 GlobalProtect Validity Period ISO 6366 Device > Certificate Management > Certificates > Trusted Certificate Authorities (CA) CA 36. Trusted Certificate Authorities CA CA CA CA CA CA CA 78 Palo Alto Networks

79 Device > Certificate Management > Certificate Profile Setup SSL-VPN GlobalProtect 30 Management Certificate Profile Username Field CA CRL OCSP CRL OCSP Receive Timeout 31 user name CA OCSP URL CA OCSP OCSP CA (CRL) (OCSP) OCSP CRL CRL 1-60 OCSP Palo Alto Networks 79

80 OCSP Device > Certificate Management > OCSP Responder OCSP Responder PAN-OS OCSP OCSP Device > Setup > Sessions Sessions Features Decryption Certificate Revocation Settings 38. OCSP Responder OCSP 31 OCSP Device > Master Key and Diagnostics Master Key and Diagnostics New Master Key Palo Alto Networks

81 39. Master Key and Diagnostic SA (HA) HA HA PAN-OS 5.0 HA HA HA 1. HA Web CLI show jobs all show jobs pending check pending-changes 2. Device > High Availability General Enable Config Sync A 4. B Enable Config Sync Palo Alto Networks 81

82 HA 1. HA HA Device > High Availability General Enable Config Sync 2. HA Web CLI show jobs all show jobs pending check pending-changes A 4. B Enable Config Sync PAN-OS / / (HA) HA / HA / HA HA HA HA HA (MGT) hello HA1 HA1 82 Palo Alto Networks

83 / HA / HA App-ID Content- ID App-ID Content-ID Layer 7 PAN-OS HA3 Layer 3 / Layer 3 HA3 App-ID Content-ID Layer 3 IP ARP IP IP Layer 3 Static interface IP Layer 3 IP / HA / Floating IP Virtual Router Redundancy Protocol (VRRP) HA IP IP IP ID IP HA ARP load sharing (ARP) / App-ID Content-ID (1) (2) / HA IP modulo IP IP modulo IP HA Primary Device Hash Palo Alto Networks 83

84 HA App-ID Content-ID HA HA3 Layer 7 / HA Layer 3 IPv6 / IPv6 / App-ID Content-ID Layer 3 IP HA IP IP MAC ARP VRRP IP VPN (NAT) IP IP IP HA MAC Layer 3 ARP ARP HA IP IP ARP IP ARP ARP Layer 3 ARP / ARP IP ping Layer 3 IP (OSPF) IP HA 84 Palo Alto Networks

85 NAT / NAT / HA / Web / NAT NAT NAT NAT NAT NAT 1 1 NAT 0 NAT Device 0 and Device 1 NAT ID IP NAT Both NAT NAT Primary NAT NAT ARP 0/1 / NAT IP IP/ IP IP/ NAT ID 0 1HA IP IP ISP / / /24 ID 0 ID 1 3. IP Palo Alto Networks 85

86 40. IP Src NAT 0 L3Trust L3Untrust dynamic-ip-andport Src NAT 1 L3Trust L3Untrust dynamic-ip-andport / HA 0 1 (ISP) IP NAT ID IP ISP ISP IP IP ISP /24 ISP / / /24 ID 1 4. IP 41. IP Src NAT 0 L3Trust L3Untrust dynamic-ip-andport Src NAT 1 L3Trust L3Untrust dynamic-ip-andport / HA Palo Alto Networks

87 IP NAT ISP /24 ISP / / /24 ID 0 ID IP IP 42. IP DNAT Prov Indep / HA L3Untrust L3Untrust HA HA PAN-OS RJ-45 HA1 HA2 HA1 HA2 / HA3 HA3 Palo Alto Networks 87

88 HA HA ethernet 1/15 ethernet 1/16 5. Network HA HA 6. HA 6. HA 88 HA HA HA HA Device > High Availability 87 HA HA HA High Availability 43. HA General Enable HA Group ID / 1 63 / Layer 2 ID Description / Mode active-active active-passive Peer HA IP Address Control Link HA1 IP Backup Peer HA IP Address IP Enable Config Sync Link Speed / HA Link Duplex / HA 88 Palo Alto Networks

89 43. HA Device Priority Heartbeat Backup HA hello HA1 IP HA Preemptive Preemption Hold Time Promotion Hold Time / / HA Hello Interval HA hello Heartbeat Interval HA ICMP ping Maximum No. of Flaps active 15 flap suspended 0 Passive firewall flap Monitor Fail Hold Up Time (ms) HA Additional Master Hold Up Time (min) / / / Palo Alto Networks 89

90 43. HA Control Link (HA1)/ Control Link (HA1 Backup) HA HA1 HA [ ] Heartbeat Backup HA HA1 HA Heartbeat Backup HA PA-200 HA HA1 HA [ ] Heartbeat Backup HA HA HA HA HA Port HA1 HA IPv4/IPv6 Address HA1 HA1 IPv4 IPv6 Netmask HA1 IP Gateway HA1 IP Link Speed HA HA1 HA HA1 Encryption Enabled HA HA HA HA HA1 Certificates / 60 Monitor Hold Time (ms) HA1 90 Palo Alto Networks

91 43. HA (HA2) Port HA HA2 IP Address HA2 HA IPv4 IPv6 Netmask HA2 HA Gateway HA2 HA HA HA2 IP Gateway Enable Session Synchronization Transport Ethernet (Ethertype 0x7261) IP Layer 3 IP 99 UDP IP UDP Link Speed HA HA2 Link Duplex HA HA2 HA2 keep-alive HA HA2 HA2 HA Action log-only HA2 HA2 / split data-path / HA active/active Threshold (ms) HA2 HA2 keep-alive HA Palo Alto Networks 91

92 43. HA Link and Path Monitoring Link Groups Enabled IP ICMP ping Layer 2 Layer 3 Failure Condition VLAN Name Enabled Failure Condition Source IP VLAN IP IP IP IP IP IP Destination IPs Ping Interval ping , Ping Count ping 3-10 ping 10 ping Enabled Failure Condition Name Enabled Failure Condition Interfaces 92 Palo Alto Networks

93 43. HA Active Passive Passive Link State Active/Active HA3 VR QoS auto Layer 2 Layer 3 shutdown [ ] HA3 App-ID Content-ID Layer 7 / HA HA QoS QoS Network QoS QoS Primary Device / Layer 7 First packet App-ID Content-ID Layer 7 HA3 IP Modulo IP Primary Device IP Hash IP IP Palo Alto Networks 93

94 43. HA IPv4 IPv6 HA / HA ARP LAN ARP WAN IP 84 Floating HA IP IP IP HA Device 0 Priority IP Device 1 Priority IP Failover address if link state is down ARP Load Sharing HA IP IP Modulo ARP IP ARP IP Hash ARP IP ARP Suspend local device HA HA HA HA IP HA LED request high-availability state suspend CLI Device High Availability Suspend 94 Palo Alto Networks

95 CLI request high-availability state functional HA CLI show high-availability all CLI show high-availability state Device Config Audit Dashboard HA Widget Web CLI request high-availability sync-to-remote running-config CLI show jobs processed HA Lite PA-200 VM Lite / HA HA Lite Lite IPSec DHCP DHCP PPPoE Layer 3 VLAN 129 NAT QoS PA-4000 PA-5000 PA-2000 PA-3000 PA-500 PA-200 Palo Alto Networks 95

96 7 1 VSYS 2 VSYS 3 VSYS 4 VSYS vsys vsys vsys vsys 7. (vsys1) Policies Objects VLAN 99 SNMP 96 Palo Alto Networks

97 Dept 1 VSYS Dept 2 VSYS VSYS 1 VSYS 2 VSYS 1 VSYS 2 VSYS 2 VSYS 1 VSYS 1 VSYS 2 VSYS 3 VSYS 4 VSYS 8. Palo Alto Networks 97

98 97 IP a.a.a.a b.b.b.b c.c.c.c d.d.d.d 1 VSYS 2 VSYS 3 VSYS 4 VSYS 9. ISP IP IP 10 x.x.x.x a.a.a.a b.b.b.b c.c.c.c d.d.d.d 1 VSYS 2 VSYS 3 VSYS 4 VSYS 10. NAT 98 Palo Alto Networks

99 Device > Virtual Systems Device > Setup Management General Settings Multi Virtual System Capability Virtual Systems 44. ID General Resource 31 DNS Proxy DNS Proxy 149 DNS Proxy VLAN Sessions Limit Security Rules NAT Rules NAT Decryption Rules QoS Rules QoS Application Override Rules PBF Rules (PBF) CP Rules (CP) DoS Rules (DoS) Site to Site VPN Tunnels VPN Concurrent GlobalProtect Tunnel Mode Users GlobalProtect VLAN Network > Zones 129 Network > Interfaces Palo Alto Networks 99

100 Device > Shared Gateways Layer 3 Layer Layer ID 31 Device > Response Pages URL HTML A 46. Antivirus Block Application Block Captive Portal Comfort File Blocking Block File Blocking Continue GlobalProtect Portal Help GlobalProtect Portal Login GlobalProtect Welcome SSL 188 GlobalProtect GlobalProtect GlobalProtect 293 GlobalProtect GlobalProtect 293 SSL 100 Palo Alto Networks