article Nominated Discussion: Setting Up a New Palo Alto Firewall in General Articles

article Nominated Discussion: Setting Up a New Palo Alto Firewall in General Articles https://live.paloaltonetworks.com/t5/general-articles/nominated-discussion-setting-up-a-new-palo-alto-firewall/ta-p/573696 <DIV class="lia-message-template-content-zone"> <P><SPAN>This Nominated Discussion Article is based on the post "</SPAN><STRONG><A href="https://live.paloaltonetworks.com/t5/next-generation-firewall/internet-gt-pa-440-gt-asus-rt-ax53u-ax1800-error-router-does-not/m-p/573318#M2452" target="_self">Internet -> PA-440 -> ASUS RT-AX53U AX1800. Error = Router does not get Internet access</A> </STRONG><SPAN>" by <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/1278321707">@SoloSigma</a> and answered by Cyber Elite <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/7608">@reaper</a>. Read on if you are curious about setting up a new firewall yourself!</SPAN></P> <P> </P> <BLOCKQUOTE> <P>I have just purchased my first Palo Alto firewall. I am a sysadmin at a small office (about 20 people) and I am in the progress of setting up a new WiFi for my office.</P> <P> </P> <P>This is my equipment:</P> <P> </P> <UL> <LI>Firewall:<SPAN> </SPAN><SPAN>PA-440</SPAN></LI> <LI>Router:<SPAN> </SPAN><SPAN>Asus RT-AX53U AX1800</SPAN></LI> </UL> <P><SPAN>This is my current setting:</SPAN></P> <P> </P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 1_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 627px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56703i0B28F02CA128CDBA/image-size/large?v=v2&px=999" role="button" title="Fig 1_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 1_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P> </P> <P> </P> <P><SPAN>I have managed to connect to the PA-440 firewall by setting my network cards IP to 192.168.1.2.</SPAN></P> <P> </P> <P><SPAN>What should I do in order to make my router get Internet? I have some screenshots of my setup here:</SPAN></P> <P> </P> <P><STRONG>PA-440 Dashboard</STRONG></P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 2_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56704iF3AE8EE7A089BFC8/image-size/large?v=v2&px=999" role="button" title="Fig 2_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 2_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P> </P> <P><STRONG>PA-440 Interfaces<BR /></STRONG></P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 3_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56705iE743F4D63937B1E4/image-size/large?v=v2&px=999" role="button" title="Fig 3_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 3_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P> </P> <P><STRONG> </STRONG></P> <P> </P> <P><STRONG><SPAN>Asus RT-AX53U AX1800</SPAN><SPAN> </SPAN>dashboard<BR /></STRONG></P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 4_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 998px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56706iAAAE01D1B547555A/image-size/large?v=v2&px=999" role="button" title="Fig 4_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 4_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P> </P> <P> </P> <P><STRONG><SPAN>Asus RT-AX53U AX1800 </SPAN>LAN<BR /></STRONG></P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 5_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56707iC7EC2AFB5949CD53/image-size/large?v=v2&px=999" role="button" title="Fig 5_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 5_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P> </P> <P> </P> <P><STRONG><SPAN>Asus RT-AX53U AX1800 </SPAN>LAN</STRONG><SPAN> </SPAN>-<STRONG>> DHCP</STRONG></P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 6_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56708iC3C7D2F6E17A8C9A/image-size/large?v=v2&px=999" role="button" title="Fig 6_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 6_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P> </P> <P> </P> <P><STRONG><SPAN>Asus RT-AX53U AX1800</SPAN><SPAN> </SPAN>WAN<BR /></STRONG></P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 7_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56709i390D36405A033D5A/image-size/large?v=v2&px=999" role="button" title="Fig 7_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 7_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P> </P> <P> </P> </BLOCKQUOTE> <P> </P> <H2 id="toc-hId-1540485285"><FONT color="#FF6600">Solution:</FONT></H2> <P> </P> <P>There's a good book you can read<SPAN> </SPAN><SPAN class="lia-unicode-emoji" title=":winking_face:"><span class="lia-unicode-emoji" title=":winking_face:">😉</span></SPAN></P> <P> </P> <P>There's a lot of stuff you can do but let's start with the basics</P> <P> </P> <P>Create 2 new layer3 zones</P> <P> </P> <P>I'd firstly set the interface 1/1 to layer 3 mode and set it as dhcp client. that should get you a public IP automatically from your ISP</P> <P> </P> <P>Assign it the external zone</P> <P> </P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 8_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 665px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56710i2D3373F30F63812E/image-dimensions/665x369?v=v2" width="665" height="369" role="button" title="Fig 8_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 8_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P> </P> <P>Next, set the ethernet1/2 as a layer3 interface and assign it an IP address (e.g. 192.168.50.1/24), and enable a dhcp server on that interface, make sure you set the 192.168.50.1 IP as default route in the dhcp features</P> <P> </P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 9_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 673px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56711i0DF918BFED79D642/image-dimensions/673x557?v=v2" width="673" height="557" role="button" title="Fig 9_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 9_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P>Now, it would be preferable if you can set your Asus in passthrough mode so it simply acts as an access point and not interfere with routing or additional NAT inside your network</P> <P> </P> <P>Don't forget to create a security rule that allows your new internal zone out to your new external zone (delete the rule that was already in place, fresh starts are better)</P> <P> </P> <P>Make sure to add your subscription profiles!</P> <P> </P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 10_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 918px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56712i4B0DD69492E2F216/image-size/large?v=v2&px=999" role="button" title="Fig 10_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 10_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P> </P> <P>And lastly, create a NAT rule for your outbound traffic:</P> <P> </P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 11_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56713iEA5F3F65F978209C/image-size/large?v=v2&px=999" role="button" title="Fig 11_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 11_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P> </P> <P>To ensure your firewall is able to fetch updates, configure it with a DNS server in the management section, then consider setting up 'service routes'  (Device > setup > service > service routes) attached to your ethernet1/2 (as else the updates will be fetched via your management interface which is currently not connected to anything)</P> <P> </P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Fig 12_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" style="width: 879px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56714iB3218D22C5731E8E/image-dimensions/879x697?v=v2" width="879" height="697" role="button" title="Fig 12_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" alt="Fig 12_Nominated Discussion-Setting-Up-a-New-Firewall_palo-alto-networks.png" /></span> <P> </P> </DIV> Fri, 19 Jan 2024 23:11:32 GMT JayGolf 2024-01-19T23:11:32Z Nominated Discussion: Setting Up a New Palo Alto Firewall https://live.paloaltonetworks.com/t5/general-articles/nominated-discussion-setting-up-a-new-palo-alto-firewall/ta-p/573696 <P><SPAN>This Nominated Discussion Article is based on the post "</SPAN><STRONG><A href="https://live.paloaltonetworks.com/t5/next-generation-firewall/internet-gt-pa-440-gt-asus-rt-ax53u-ax1800-error-router-does-not/m-p/573318#M2452" target="_self">Internet -> PA-440 -> ASUS RT-AX53U AX1800. Error = Router does not get Internet access</A> </STRONG><SPAN>" by <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/1278321707">@SoloSigma</a>  and answered by Cyber Elite <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/7608">@reaper</a>.</SPAN></P> Fri, 19 Jan 2024 23:11:32 GMT https://live.paloaltonetworks.com/t5/general-articles/nominated-discussion-setting-up-a-new-palo-alto-firewall/ta-p/573696 JayGolf 2024-01-19T23:11:32Z