{"id":32126,"date":"2019-10-31T21:45:18","date_gmt":"2019-10-31T18:45:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/osobennosti-nastrojki-palo-alto-networks-ssl-vpn\/"},"modified":"2019-10-31T21:45:18","modified_gmt":"2019-10-31T18:45:18","slug":"osobennosti-nastrojki-palo-alto-networks-ssl-vpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/osobennosti-nastrojki-palo-alto-networks-ssl-vpn","title":{"rendered":"Features of Configuring Palo Alto Networks: SSL VPN","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Features
\n
\nDespite all the advantages of Palo Alto Networks firewalls, there is not much material available in Russian networks regarding the configuration of these devices, as well as texts describing the experience of their implementation. We decided to summarize the materials we have accumulated over time while working with this vendor's equipment and share the peculiarities we encountered during various project implementations. <\/p>\n

To get acquainted with Palo Alto Networks, this article will cover the configurations necessary to solve one of the most common tasks of firewalling: SSL VPN for remote access. We will also discuss auxiliary functions for general firewall configuration, user identification, applications, and security policies. If readers find the topic interesting, we will later publish materials detailing Site-to-Site VPN<\/a>, dynamic routing, and centralized management using Panorama.
\n<\/a><\/noindex>
\nPalo Alto Networks firewalls utilize a number of innovative technologies including App-ID, User-ID, and Content-ID. The application of these functionalities ensures a high level of security. For example, App-ID can identify application traffic based on signatures, decoding, and heuristics, regardless of the port and protocol used, including within an SSL tunnel. User-ID allows for user identification in the network through integration with LDAP. Content-ID enables traffic scanning and identification of transferred files and their contents. Other features of firewalls include intrusion prevention, vulnerability protection, DoS attack protection, built-in anti-spyware, URL filtering, clustering, and centralized management.<\/p>\n

For demonstration purposes, we will use an isolated test environment with a configuration identical to a real one, except for the device names, AD domain name, and IP addresses. In reality, things are more complex\u2014there may be many branches. At the borders of central sites, a cluster will be installed instead of a single firewall, and dynamic routing may also be required.<\/p>\n

The test environment uses PAN-OS 7.1.9<\/b>As a typical configuration, let\u2019s consider a network with a Palo Alto Networks firewall at the perimeter. The firewall provides remote SSL VPN access to the headquarters. An Active Directory domain will be used as the user database (Figure 1).<\/p>\n

\"Features
\nFigure 1 \u2013 Structural Diagram of the Network<\/i><\/p>\n

Configuration steps:<\/p>\n

    \n
  1. Device Preconfiguration. Setting the name, an IP address<\/a> management, static routes, administrator accounts, management profiles<\/li>\n
  2. License installation, configuration, and update installation<\/li>\n
  3. Configuration of security zones, network interfaces, traffic policies, address translation<\/li>\n
  4. Configuration of the LDAP authentication profile and User Identification feature<\/li>\n
  5. SSL VPN Configuration<\/li>\n<\/ol>\n

    <\/p>\n

    1. Preconfiguration<\/h4>\n

    \nThe main configuration tool for the Palo Alto Networks firewall is the web interface, management can also be performed via CLI. By default, the management interface has been assigned the IP address 192.168.1.1\/24, login: admin, password: admin. <\/p>\n

    The address can be changed either by connecting to the web interface from the same network, or by using the command set deviceconfig system ip-address netmask<\/b>. This is executed in configuration mode. To switch to configuration mode, the command configure<\/b>is used. All changes to the firewall take effect only after confirming the settings with the command commit<\/b>, both in CLI mode and in the web interface.<\/p>\n

    To change settings in the web interface, use the section Device -> General Settings and Device -> Management Interface Settings.<\/b> Name, banners, time zone, and other settings can be specified in the General Settings section (Figure 2).<\/p>\n

    \"Features
    \nFigure 2 \u2013 Management Interface Parameters<\/i><\/p>\n

    In the case of a virtual firewall in an ESXi environment, the General Settings section must enable the use of the MAC address assigned by the hypervisor, or configure the hypervisor with the MAC addresses specified on the firewall interfaces, or modify the settings of the virtual switches to allow MAC address changes. Otherwise, traffic will not pass.<\/p>\n

    The management interface is configured separately and is not displayed in the list of network interfaces. In the section Management Interface Settings<\/b> the default gateway for the management interface is specified. Other static routes are configured in the virtual routers section, which will be discussed later. <\/p>\n

    To allow access to the device through other interfaces, it is necessary to create a management profile. Management Profile<\/b> in the section Network -> Network Profiles -> Interface Mgmt<\/b> and assign it to the corresponding interface. <\/p>\n

    Next, DNS and NTP need to be configured in the section Device -> Services<\/b> for obtaining updates and displaying the correct time (see Fig. 3). By default, all traffic generated by the firewall uses the management interface's IP address as the source IP address. A different interface can be assigned for each specific service in the section Service Route Configuration<\/b>.<\/p>\n

    \"Features
    \nFigure 3 \u2013 DNS, NTP, and system route service parameters<\/i><\/p>\n

    2. Installing licenses, configuring, and setting up updates<\/h4>\n

    \nFor the full functionality of the firewall, a license must be installed. A trial license can be obtained from Palo Alto Networks partners. Its duration is 30 days. The license can be activated either through a file or using an Auth-Code. Licenses are configured in the section Device -> Licenses<\/b> (see Fig. 4).
    \nAfter installing the license, it is necessary to configure updates in the section Device -> Dynamic Updates<\/b>.
    \nIn the section Device -> Software<\/b> new versions of PAN-OS can be downloaded and installed.<\/p>\n

    \"Features
    \nFigure 4 \u2013 License management panel<\/i><\/p>\n

    3. Configuring security zones, network interfaces, traffic policy, address translation<\/h4>\n

    \nPalo Alto Networks firewalls apply zone logic when configuring network rules. Network interfaces are assigned to a specific zone, and this is used in traffic rules. This approach allows for changes in interface settings in the future without changing traffic rules, but rather reassigning the necessary interfaces to the corresponding zones. By default, traffic within a zone is allowed, and traffic between zones is denied; this is handled by the pre-installed rules intrazone-default<\/b> and interzone-default<\/b>.<\/p>\n

    \"Features
    \nFigure 5 \u2013 Security zones<\/i><\/p>\n

    In this example, the interface in the internal network is assigned to the zone internal<\/b>, while the interface directed to the Internet is assigned to the zone external<\/b>. A tunnel interface is created for SSL VPN assigned to the zone vpn <\/b>(see Fig. 5).<\/p>\n

    Palo Alto Networks firewall network interfaces can operate in five different modes:<\/p>\n