topic Re: Palo Alto 200 Setup for home use in General Topics

Palo Alto 200 Setup for home use

Hmtreviz — Thu, 11 Aug 2016 21:44:41 GMT

I have been given a PA200 to setup at home to get myself familiar with Palo Alto firewalls. I have a cable modem and wireless router that will need to be connected to the PA200. I have followed the instructions on this article to get it setup:

https://live.paloaltonetworks.com/t5/Configuration-Articles/Setting-Up-the-PA-200-for-Home-and-Small-Office/ta-p/61838

My problem once I comptleted the setup is that I cannot browse out to the internet. What am I doing wrong or what am I missing? Any help would be appreciated.

Thanks,

Hector

Re: Palo Alto 200 Setup for home use

TranceforLife — Fri, 12 Aug 2016 08:49:13 GMT

Hi,

Double check you security policy, NAT configuration. Remember that you are doing double NAT so check carefully your NAT policy. What about your security logs? Is your traffic permitted or denied ?

Thx,

Myky

Re: Palo Alto 200 Setup for home use

reaper — Fri, 12 Aug 2016 14:27:49 GMT

Hi Hector

it may be a good idea to create a temporary 'any any' security policy with a drop action and logging enabled at the very end of the rulebase to make sure dropped sessions are logged to help visualize anything that may not be picked up by a policy

next, you'll want to take a look at your traffic logs

is anything being blocked by the rule you created, is there a lot/exclusively logs with 'incomplete' as the action? these would mean packets are going out but nothing is coming back

this could be due to a routing or a natting issue

if there are no logs, your internal hosts may be pointing to an incorrect gateway, the subnet on your interface may not correspond to you clients or may be in a different subnet altogether

please also take a look at these articles to help you get started: Getting Started: The Series

Re: Palo Alto 200 Setup for home use

Hmtreviz — Wed, 17 Aug 2016 01:37:43 GMT

Sorry for replying so late. I have only on NAT setup and its the one specified on the instructions. I also created a temporary any any rule and moved it to the top to no avail. One other thing, the logs are not getting generated now so I cant see where the blocks are. How did i stop the logs from showing up?

Thanks,

Hector

Re: Palo Alto 200 Setup for home use

TranceforLife — Wed, 17 Aug 2016 06:48:40 GMT

Hi Hector,

Please check if you have a log enabled fro the security policy:

Generally, should be enabled on the "session end".

Re: Palo Alto 200 Setup for home use

Hmtreviz — Wed, 17 Aug 2016 12:44:06 GMT

Thanks, I did check both secuirty policies and they are set to "Log at Session End". Also, I was thinking my routing could have been setup wrong. I have the following:

Cable modem: 192.168.100.1 - After I log in I see CM MODEM IP and its on a 10.x.x.x network

Wireless Router: 192.168.1.253

PA: 192.168.1.252

What should my routing be setup as?

-Hector

Re: Palo Alto 200 Setup for home use

BPry — Wed, 17 Aug 2016 13:26:53 GMT

Are you running this plugged into your wireless router? Where is your default routing statement currently sending your traffic, are you trying to send it directly to your modem or your wireless router? Generally speaking you would replace your wireless router with your PA-200.

It may be a little more helpful if you send a screenshot of how you actually setup the routing on this device, I suspect at this point that routing is likely your issue.

Re: Palo Alto 200 Setup for home use

TranceforLife — Wed, 17 Aug 2016 14:53:37 GMT

Hi,

So you have to have a static default route configured on your PA pointing to your router IP address. But as BPry said it is better to see a topology so will be much easier to help you.

Thx,

Myky

Re: Palo Alto 200 Setup for home use

Hmtreviz — Thu, 18 Aug 2016 01:40:50 GMT

Re: Palo Alto 200 Setup for home use

Hmtreviz — Thu, 18 Aug 2016 01:46:43 GMT

The setup instructions state to set up the route "pointing to the ISP's next hop". This is where i'm getting confused, am i supposed to send it to my wireless router, to the cable modem, or the hop after the cable modem?

Thanks,

Hector

Re: Palo Alto 200 Setup for home use

TranceforLife — Thu, 18 Aug 2016 13:42:01 GMT

Hi Hector,

So if you are connected to the Internet "through" your wireless router (you got a cable going to the router) then static route should be pointing to the wireless router IP address. Your cable modem as l understood there just for signal converting, so you cannot manage it. Is it similar for this set-up:

Please could you confirm your wireless router IP address/network? Also email me here: mayk.08@mail.ru so I can send you few more helpful info.

Thx,

Myky

Re: Palo Alto 200 Setup for home use

BPry — Thu, 18 Aug 2016 13:24:22 GMT

Your setup is rather odd and without looking over the total configuration I can't tell whats wrong, I can only take crack shots on the information you provide. I did notice that the current route for 192.168.1.0/24 is showing your next hop as 192.168.1.254, which I didn't see mentioned anywhere on your network setup. What does your interface configuration look like?

This might be a little faster to just dump the configuration, take out everything you don't want people to see, and upload the file. I feel like there may be multiple small configuration errors across the configuration that you are running into, that would take a while for the forum to pinpoint each individual issue with screenshots.

It might be worth throwing your wireless router out of the picture and setting up an "UnTrust" zone on your firewall along with a "Trust" zone, and setting your "UnTrust" interface as DHCP. Understanding that you will still need wireless put your Wireless Router behind the firewall and simply put it in AP mode. Running your firewall behind your wireless router isn't exactly the best setup anyways from a security perspective, as this would allow wireless users to completely bypass any security that you have setup on the firewall.

Re: Palo Alto 200 Setup for home use

TranceforLife — Thu, 18 Aug 2016 22:14:45 GMT

Hi,

If your wireless router IP is 192.168.1.253 then you got you default route correct. Use Layer 3 mode for your interfaces configuration. Your PA interface has assigned ip 192.168.1.254/24. Put this interface to the "untrust" zone. Create another "trust"zone with different IP address range, assigned other interface to this zone, set up DHCP with. For DNS you can use your wifi router IP or Google dns. For the client in the "trust" zone DG is going to be your PA interface (trust zone IP). Configure NAT (PAT) pointing to your external PA IP address (192.168.1.254). Create security policy for traffic going from the "trust"> "untrust" zone. This will be enough for you get you familiar with Palo Alto, so you can test things but it is temporary set-up 🙂

Hope it helps.

Thx,

Myky

Re: Palo Alto 200 Setup for home use

mivaldi — Fri, 19 Aug 2016 03:11:28 GMT

Why would you point the default route to the wireless, that means your wi-fi won't go through the firewall.

In step 3 there are two if statements, you either do one or the other.

If you have a cablemodem then it is most likely serving DHCP. Just configure ethernet1/1 as DHCP client and accept whatever default route the cablemodem gives you, no need for manual input of static route.

And remember to restart the cablemodem so that it releases the association to the MAC address of your old device.

Re: Palo Alto 200 Setup for home use

TranceforLife — Fri, 19 Aug 2016 06:22:50 GMT

Hi,

As l understand he cannot connect/attached Palo directly to the mode, that is why he has to go through the wireless route.

Sure you are correct if you can connect Palo directly to the modem.

p.S I could do it because my modem/router is Virgin Media and has specific interface:

Re: Palo Alto 200 Setup for home use

mivaldi — Fri, 19 Aug 2016 18:49:28 GMT

One of those cablemodems with integrated wifi, if you want to secure your wifi users you'll need to forget about the modem wifi capabilities and install a separate Wifi router, otherwise all wireless clients will go straight out to the internet through the modem.

The yellow ports will lease RFC1918 addresses on DHCP, so just use any of those ports as a regular non-wifi integrated cablemodem.

Since these also do NAT inside, you will need to enable any port forwarding to the outside. I'd recommend you configure a 'DMZ Host' (forward all TCP and UDP ports to a single IP) pointing to the WAN IP of the Firewall, so no need to worry opening ports twice every time you want to host a service to the outside.

Re: Palo Alto 200 Setup for home use

BPry — Fri, 19 Aug 2016 17:13:02 GMT

mivaldi is right, if this is a modem with integrated wireless then just forget that you modem even has a wireless option and shut it off. Keeping that wireless signal on would defeat any purpose of having a PA protecting your network. You can setup the DHCP to act as a relay or create your own DHCP options, perosnally I would recommend putting the DHCP on the PA itself since it allows you to easy switch your computers away from your ISPs DHCP servers.

I would recommend moving your equipment away from the 192.168.1.* addresses, everybody uses 192.168.1. I assumed from your first post the interface IP was 192.168.1.252, if you are using 192.168.1.254 as your interface IP then that route is currect. I would be your network around the PA-200 to simulate an enviroment that you would actually be working with, leaving it behind everything isn't what you are going to see out in the real world.

I'm not sure from your wording if your wireless router is built into your modem or not, as you referenced them as two different pieces of equipment I'm going to guess that they are not. Put you wireless router behind your PA and plug your PA directely into the modem. You may or may not have to actually power cycle the modem to get it to provide an IP address to your PA. The "Outside" port that you are using on your PA can be set to DHCP to automatically pull all the required informaiton for you, then let it build the default route. Then you can start working on the "inside" and wireless zone/ports and their security policies to actually start moving traffic.

Re: Palo Alto 200 Setup for home use

TranceforLife — Fri, 19 Aug 2016 18:21:57 GMT

I am with you, but my set up was just simple and purely for "learning" or "familiarising" with PA as per original request. Hector doesn't want to install PA at home for the protection (you don't even need it for home), he just wants to get a skills. The quicker you configure the more time you have for practice 🙂

Of cause with this set-up, WiFi users will not be traversing the PA ( from the Palo view they will be in "untrust" zone) hence no security policy applies. Anyway, l respect every opinion and every comment. This is what I had configured in my home when was doing CBT Nuggets:

So it is simple and it worked for me.

Thx,

Myky

Re: Palo Alto 200 Setup for home use

mivaldi — Fri, 19 Aug 2016 18:34:47 GMT

It looks like you spent some time drawing this, awesome diagram!

Re: Palo Alto 200 Setup for home use

mivaldi — Fri, 19 Aug 2016 18:43:51 GMT

This photo (message 11) shows you're connecting the modem to the WAN port of your wifi router. It should go to the designated WAN of the firewall instead, Also you don't want to be doing source NAT twice (dont use the WAN port of the wifi router!), let the firewall do the Source NAT. Will also make your life difficult since if you want to open any ports to the outside (DNAT rules), you would have to punch that hole twice, once in the firewall and yet again on your wifi router.

And the most crucial, the coax is not connected to the modem 🙂