topic Re: Starting with Palo Alto Networks - What I wish I had known... in General Topics

Starting with Palo Alto Networks - What I wish I had known...

carnould — Fri, 24 Mar 2017 20:57:57 GMT

Beginnings are not always perfect. Whether you started your Palo Alto Networks journey years ago or just recently, tell us what you learned early on that you wish you had known before.

If there was one thing, or maybe more, Live Community users would love to hear about it. Share your stories, your tips to help other users along the way.

Read a tip you like, make sure to like it or let them know by commenting!

The most popular and helpful stories will get you a cool new Live Community t-shirt!

Looking forward to reading all the great stories!

@carnould

Re: Starting with Palo Alto Networks - What I wish I had known...

santonic — Mon, 27 Mar 2017 07:53:51 GMT

I wish i had known about this active and helpful comunity from the start. Do I get a t-shirt for posting first? 🙂

Re: Starting with Palo Alto Networks - What I wish I had known...

TranceforLife — Mon, 27 Mar 2017 08:19:26 GMT

It is probably will be more as a feedback from my side but every time l am dealing with Palo issues, either it is through the TAC or community l always come across nice people. Didn't have any negative experience. All information really here and l would never believe that the community can be so helpful. Keep it up and thanks all!

p.s l also like this new t-shirt :0

Re: Starting with Palo Alto Networks - What I wish I had known...

DPoppleton — Mon, 27 Mar 2017 20:05:04 GMT

I have less than a year experience, but I wish I had known to look in the "Unified" logs for the reasons things would be blocked. I've seen traffic allowed in the traffic logs but blocked because the file that was attempted to be downloaded wasn't of a permitted type. It was confusing at first when I saw the traffic permitted.

Re: Starting with Palo Alto Networks - What I wish I had known...

carnould — Mon, 27 Mar 2017 21:19:04 GMT

We love to hear that so thank you @santonic. I do think you deserve a t-shirt for posting first so stay tuned!

Keep posting!

Christine

Re: Starting with Palo Alto Networks - What I wish I had known...

BPry — Tue, 28 Mar 2017 14:35:47 GMT

The benefit of using the forums unless I actually need emergency support through TAC. A lot of the frontline support folks love to simply get your configuration and 'verify it for issues' when there really isn't a need for it; heck simply opening up a ticket for the weird URLs I was seeing on my botnet report the first line support was adimit that the predefined report was in some way misconfigured on my end.

In the past I've worked through issues soley by myself because I loathed contacting support and having to do the same troubleshooting steps I had already done multiple times, or hearing how I should try to restart in the middle of the day to fix the issue. In the forums it's by far more likely that you'll either get told the solution or be told to restart a specific process, instead of restarting the whole data/management plane.

Re: Starting with Palo Alto Networks - What I wish I had known...

DavidGuzman — Thu, 30 Mar 2017 21:34:27 GMT

I've been administrating a Palo Alto Firewall for 3 years now and think it's a really good tool, it friendly and faily easy to configure and manage. It has helped to improve our traffic controll and solve connection issues. I do encourage other administrators to use it!

Re: Starting with Palo Alto Networks - What I wish I had known...

Davide_Fini — Fri, 31 Mar 2017 00:02:46 GMT

i've been working with Cisco ASA before start using Palo Alto more than 4 years ago. since the first beginning i've appreciated the very friendly web interface and the huge amount of feature which are very helpful to manage our network and security.

especially indicated for corporate and sysadmins focused on the websecurity, you have a lot of automated and manual tools to prevent, detect properly attempts of breaches and vulnerabilities.

growing and growing version after version, i can't wait to see and test the 8 version.

Re: Starting with Palo Alto Networks - What I wish I had known...

jjb3k — Fri, 31 Mar 2017 20:30:07 GMT

If I knew then what I know now.....

1. Use Panorama for (almost) everything. Building all objects, profiles, zones, and policies in Panorama has numerous manageability/scalability benefits. Other than network interfaces, virtual routers, and IPSec tunnels, build everything else in Panorama and push it to the firewalls.

2. Use nested device groups in Panorama to create a hierarchy for shared security policies. This allows a single rule, created once, to be applied to multiple firewalls.

3. Template grouping should be based on device model do to zone limitations. Device grouping should be based on function or purpose.

4. Using tags, and corresponding colors, in your security rules helps with visual grouping the rules, and can also help with searching and filtering.

Re: Starting with Palo Alto Networks - What I wish I had known...

MatthewSabin — Thu, 13 Apr 2017 17:30:55 GMT

I'm about 2-months in, and I'm still looking for what I need to know.

What I most want is the "How to think Palo Alto" guide - the biggest picture of how the parts fit together, and the minute details of what little "other-guy" process or method doesn't work here.

I'll publish it myself once I think I have it 😉

Re: Starting with Palo Alto Networks - What I wish I had known...

carnould — Thu, 13 Apr 2017 21:56:05 GMT

And the WINNERS SO FAR ARE:

Published in LiveWeek 12 Friday April 7th 2017.

Your time to share - "What I wish I had known"

Community is all about sharing ideas and best practices. Whether you started your Palo Alto Networks journey years ago or just last month, your experience can really help others. Share your story with other Live users.

Thanks to @santonic, @DPoppleton, @BPry and @jjb3k for all the valuable insight - each user will receive the hot off the press Live Community t-shirt!

Keep sharing - more t-shirts to grab!

Re: Starting with Palo Alto Networks - What I wish I had known...

DPoppleton — Mon, 17 Apr 2017 15:56:14 GMT

Do you need any info from me for the shirt?

Re: Starting with Palo Alto Networks - What I wish I had known...

nikoo — Mon, 17 Apr 2017 16:07:38 GMT

Hi,

Beginning are always clumsy, but one of the first things I was impressed - community and knowledge base articles. I cannot stress enough how many times articles around here have helped me to get around some issues or simply get to know some feature.

Anyway, when I got into PA firewalling, it all looked nice and shiny and overall easy to deal with, so it felt good, but some things I've learned over time:

Subscribe for Security Advisories, Software Update & Content Update e-mails - that way you will always know when new feature release comes and will not miss more severe notifications about vulnerabilities - in such a cases every minute counts.
Use packet capture - that has proven my point countless times - if, for any reason, you do not believe logs - getting the capture in such a cases is easy & fast way to see what really happens from a different directions.
Learn some basic CLI - they WILL become handy one day and when that happens - it may be already stressful enough as you will not go there unless there is a really good reason. Know how to deal with HA from CLI, log structure, running debug packet diag, flow basic (https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Flow-Basic/ta-p/72556), etc.
Superb feature I learned about after a while - https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Test-Which-Security-Policy-Applies-to-a-Traffic-Flow/ta-p/53693. Testing policy match from the CLI - that really helps to understand if the traffic will pass without bothering the end-user. P.S. TCP - IP protocol 6, UDP - 17. Good to know when testing. 🙂
Features that are synchronized in HA - https://live.paloaltonetworks.com/t5/Tech-Note-Articles/High-Availability-Synchronization/ta-p/61190. Had to deal with the question - why the heck secondary device is not getting the updates from the Internet although the network setup should allow it, but, whooaaah, service routes had to be set for both devices of the HA pair saperately as they are not synced in HA.
Although it was not possible in early PA releases - it is possible to log the default security rule traffic - https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-See-Traffic-from-Default-Security-Policies-in-Traffic/ta-p/57393. I've seen some creating custom "catch-all" rule for the traffic just for the logging - not required anymore. I was told it is not possible and it turned to out to be legacy and wrong.

..and there are definitely other things, but as you see all of these are well described in Live community - you still have to find them though. 🙂

Re: Starting with Palo Alto Networks - What I wish I had known...

santonic — Wed, 19 Apr 2017 07:24:34 GMT

Thanx @carnould for the t-shirt! it arrived quickly! 🙂

Re: Starting with Palo Alto Networks - What I wish I had known...

oscaringosv — Wed, 19 Apr 2017 13:05:43 GMT

"What I wish I had known" that a complex administration appliance (Panorama) will help me in one or two clicks to apply configuration changes to almost 100 firewalls in a few seconds and not go firewall by firewall that used to take me a few hours, now it makes our company happier and more secure, quick example would be deploying an emergency content updated. WAY FASTER, thanks to Palo Alto Panorama :).

P.S: Almost all of my questions or steps by steps procedures (Like 80% of the time) are here in the community.

Re: Starting with Palo Alto Networks - What I wish I had known...

carnould — Fri, 21 Apr 2017 23:25:12 GMT

Hi @DPoppleton, Could you check your inbox or spam folder? I sent you an email on 4/7. If you can't find it, send me an email at carnould@paloaltonetworks.com. Thanks! Christine

Re: Starting with Palo Alto Networks - What I wish I had known...

Lora — Wed, 26 Apr 2017 18:25:33 GMT

The difference between FUEL Palo Alto User Group, and LIVEcommunity?

Re: Starting with Palo Alto Networks - What I wish I had known...

Retired Member — Mon, 08 May 2017 13:49:34 GMT

I wish I had time to utilize all the CBT training resources available and build a cheap lab.

cbt nuggets - good source of basic training

Udemy has some great training as well and it is cheap and easy to follow.

Access to a long term demo vmware version of PANOS for training would be helpful, I know we can get these through our sales channel but would love to get a good usable free VM to use with all options and limited connectivity.

Also I came from a networking background but hear stories of information security folks who do not and they have problems learning the networking basics. The ACE is decent but needs more teeth and something like network + or CCNA type certs should be required..

Re: Starting with Palo Alto Networks - What I wish I had known...

DarinSutton — Wed, 10 May 2017 21:20:20 GMT

wow - many things...I wish I knew then

1 - Sys logs (not packet cap nor widgets) for VPN troubleshooting

2 - when reading Traffic logs - open detailed view then bottom has firewall policy - missed that first 2-3 months

3 - reports are useful - there are many canned reports that i could schedule...

---side note - cant always make the custom report look like the canned report

4 - add widgets for anything you want to have a quick peak

5 - ACC - build custom tabs to monitor tricky scenarios over many days/weeks

6 - VPN to Cisco not as easy as other vendors - fortunatley there is a document for that

7 - newapps - started when we had 1000 or so - they keep coming and if I'm not on top of them and reading the release notes I can easily/accidentally block something ( default action) that we needed

8 - and a biggie - read the notes when a commit fails/or succeeds and there is a bunch words after.... commit succeeded but.......

9 - one i miss - no POLICY hit count - had in other vendors

10 - not an easy way to see ip to user-ID in the GUI

just a few off the top of my head - still enjoy working with these boxes tho

of 2 more

test policyies and other items from cli - nice

Re: Starting with Palo Alto Networks - What I wish I had known...

gefuchs — Wed, 10 May 2017 22:47:48 GMT

Wish I had known you could open a medium priorty support case and not get a response for over a week.