Palo Alto Basic Configuration

Updated: Feb 20, 2022

Set Static Ip address for Management Interface

Devices --> Setup --> Interfaces --> Management

Set DNS Server

Devices --> Setup --> Services

Change Default Interface for Different Services

Devices --> Setup --> Services --> Service Features --> Service Route Configuration

Device --> Setup --> Default Session Timeout

Create Zones

Let’s configure two zones named Inside and Outside. Go to Network> Zone>Add, Give the name Inside, select Type to be Layer3 and click OK. Create the same way other Zone Outside.

Configure Interfaces: Go to Network>Interfaces Click on ethernet1/1 interface change Interface Type: Layer3, set Virtual Router: default, set Security Zone: Outside, Click on IPv4 tab Assign IP Address: 192.168.112.2/24 and Click OK

Configure Routing: Each interface must be given virtual router. Network>Virtual Router>default we will add static routing. Static Routes>IPv4>Add we will go by choosing interface> ethernet1/1(as Outside), put 192.168.29.1 as the next hop due to our topology.

We may define next as VR as well in case we use separate VR for each zone.

Configure NAT/PAT: Let’s configure NAT using Dynamic IP and Port means translate all local LAN to only one IP address. I will NAT my Inside LAN 192.168.78.0/24 to 192.168.17.100 IP address of WAN. Policies > NAT > Add Let’s name it Inside-To-Outside.

Then let’s go to Translated Packet, Translation Type: Dynamic IP And Port, Address Type: Interface Address, Interface: our WAN interface ethernet 1/1 and IP Address: WAN IP. OK

Configure Security Policy: Now, create a Security Policy to allow access from Inside zone to Outside zone. Policies>Security>Add, Give the name to your Security Policy (Inside to Outside), Add Source Zone (Inside), Add Destination Zone (Outside), Allow access, in our case allowing all traffic.