Building a Palo Alto PCNSE Lab

0:00[AUDIO LOGO]

0:07Hello, and welcome.

0:09My name is Keith Barker.

0:10And in this set of videos, you and I

0:12get to focus our attention on the design and implementation

0:14of a base infrastructure for a lab

0:16that we can then use to play with, demonstrate, test,

0:19and verify a lot of the cool features

0:21on the Palo Alto Firewall.

0:22So welcome aboard, and join me the next video,

0:24as we put our plan together.

0:26I'll see you in just a moment.

0:00[AUDIO LOGO]

0:06One of the key components for a successful lab

0:08is a good design or at least a good plan regarding how we're

0:11going to implement that lab.

0:12So in this video, let's you and I put that plan together.

0:15And over the years, I had the opportunity

0:17to build labs on lots of different technologies

0:19and platforms, including physical gear.

0:22For example, a physical firewall or virtualized

0:25gear in the form of a virtual machine that

0:26could be running in ESXi or on Hyper-V or up in the cloud.

0:31And other options for virtualization

0:32for lab environments include GNS3 and EVE-NG.

0:36And so for a lab, here's what I like to do.

0:38I've got a couple of PA-440s, and that's

0:42like the baby bear these days, the baby

0:44bear hardware flavor of the Palo Alto firewall.

0:47Now, in the old days, there's a PA-200, then a PA-220,

0:50but those are all end-of-life now.

0:52Now, there's a 400 series.

0:53That's the baby bear.

0:54And there's a 410, as well as a 440 and other flavors.

0:57And as I was doing some research on these smaller versions

1:00of the firewall, the 440s included

1:02the support for logging, which is really important.

1:04They can log locally.

1:06And the lower models, like the 410s,

1:08didn't have that ability at least as of this recording.

1:11So I've got a couple of PA-440s.

1:13In fact, let me go ahead and show you one of them right now.

1:15So here is the PA-440.

1:17And on the back side here, we have a couple

1:19of connectors for power, with power 1 and power 2 that we

1:22can have fault tolerance.

1:23You have two different incoming power supplies.

1:25And then we turn it over here on the front.

1:27Here, we have eight ethernet ports.

1:29And then we have an Ethernet management port right here

1:31for out-of-band management.

1:32Then we have a little USB micro B connector for the console.

1:36There's also a traditional RJ45 connector

1:38right here that we can also use for console access.

1:40Then we have a couple of USB ports.

1:42And then some LED indicators for status over here.

1:45This is one of the two PA-440s I've got to work with here.

1:48And just a few minutes ago, I did a factory reset on it,

1:51so it's factory-fresh.

1:52And don't you just love that factory-fresh smell.

1:55All-day long.

1:56So one of the challenges with a firewall

1:57is that if we have a perfectly configured firewall, if there's

2:00no traffic to forward or analyze or route,

2:03it's a pretty boring existence.

2:05So we're also going to need some devices, like clients,

2:07and servers, and so forth, that we can use to forward traffic

2:10through the firewall in our lab environment.

2:11And to do that, I'm going to leverage a whole bunch

2:13of virtual machines.

2:14And those will be acting as our clients and servers.

2:17And so behind me, I've got a few rack servers.

2:21And one of those is a rack server that's

2:23running ESXi from VMware.

2:27And in that ESXi host, I've got a whole bunch

2:29of virtual machines running various flavors of operating

2:32systems, including a Windows Server, Windows

2:35clients, some Linux devices.

2:36And they're all connected into a virtual switch that also

2:40lives inside the ESXi hosts.

2:42And ESXi, they refer to that as a V switch.

2:44And they have the ability to go ahead

2:46and associate each of those VMs with a unique port group

2:50representing a different VLAN.

2:51So this PC here could be connected into VLAN-10,

2:54for example.

2:55And this one can be connected to VLAN-20, and VLAN-30, et

2:59cetera.

3:00And that way, we can logically place

3:01one of these virtual machines as a client or a server

3:03into any of our VLANs and have it interact with the Palo Alto

3:06firewall.

3:07Now, the next question is, well, if this

3:09is the Palo Alto firewall here, it's hardware,

3:10and we have this virtualized switch,

3:12what's the connectivity between the two?

3:14And I'm glad you asked.

3:15And that's done through a physical connection on the ESXi

3:18host.

3:18I'll go ahead and put it right here.

3:20And logically, that can go up to this switch right here.

3:22And that's going to be acting as a trunk, with 802.1q tagging.

3:26So if client 1 sends traffic down,

3:28it'll be tagged with VLAN-10.

3:30As device 2 sends traffic down, that frame of data

3:32will be tagged with VLAN-20.

3:34As client 3 sends traffic down, those frames

3:37will be tagged within 30 and so forth.

3:39So the receiving device, whether it's another switch

3:41or in our case, it's going to be a Palo Alto firewall,

3:43it can identify, oh, that's for this VLAN or that VLAN.

3:46And that's how we can integrate the two.

3:48So down here in my physical environment,

3:50I've got a physical switch.

3:51This port right here is also a trunk port.

3:53And then on the Palo Alto firewall,

3:55we could break out multiple interfaces.

3:56And we can have one interface, for example,

3:58go to a port that's assigned to VLAN-10.

4:01And another port is assigned to VLAN-20.

4:04And another port designed to VLAN-30.

4:06However, in a lab environment, what

4:09I discovered is that when we start doing features

4:11such as high availability and we have multiple firewalls,

4:13you have lots of ports, it's a pain.

4:15You have to physically connect all those ports

4:17from each firewall into the same VLAN.

4:19So another option, which I propose we do,

4:22is to go ahead and use trunking once again.

4:24So if this port right here is configured as a trunk

4:27and this port right here is configured as a trunk,

4:29we can take our Palo Alto firewall.

4:30I'll go out and draw it right here.

4:32So here's our firewall.

4:33And we take one of its interfaces.

4:34Let's take this one right here and plug that physical ethernet

4:37port into this trunk port.

4:38And then on the firewall, we can just logically

4:41create Layer 3 subinterfaces.

4:44And the subinterfaces, we can create our subinterface

4:46to support VLAN-10.

4:48We can create a set of interfaces for VLAN-20,

4:50a subinterface to support VLAN-30, and a subinterface

4:53to support each and every separate subnet

4:55and VLAN that we have in this virtualized environment.

4:58And when building a lab environment,

4:59I learned this trick about 20 years ago

5:01when I started studying for my CCIE.

5:04And I discovered that by having one physical port

5:06and then just logically carving out the interfaces we need,

5:09again, is a lot quicker as far as physical cable

5:11management and everything else when

5:13working in a lab environment.

5:14So with that concept in mind about using one physical port

5:17and then supporting multiple logical Layer 3

5:19subinterfaces off that physical port with trunking,

5:21let's go ahead and put a design together for our overall lab.

5:24So let me go ahead and clean this up just a little bit.

5:27In fact, let me clear it up a lot.

5:28And let's design our lab.

5:29So we'll have a firewall here.

5:31And I'm going to call this PA-18.

5:34That's going to remind me that, hey, Keith, this firewall

5:37is going to use dot 18 for all of its IPv6

5:40addressing for each of its logical interfaces.

5:42So that's going to be our firewall.

5:44And then we're going to want some connectivity

5:46to the outside world.

5:47I find that very helpful when testing real-world scenarios.

5:50So for connectivity to the outside world, so

5:52this would represent the internet.

5:53Let's have two different service providers.

5:56We have service provider A service provider

5:58B. That will be going through.

5:59And that we'll be using two different logical interfaces

6:02on the Palo Alto.

6:03And we'll label those here in just a moment.

6:05And with service provider A, the network

6:07is 23.1.2.0, with a 24-bit mask.

6:10And for the network going to service provider B,

6:12it's 24.1.2.0.

6:15And I just want to point out also

6:16that those are globally routable addresses,

6:18but I'm also using them here locally in my lab, as well.

6:21And then as traffic goes out to the real internet,

6:23I've got a few other devices in the path doing

6:25additional network address translation

6:27to make everything happy.

6:28So I use these address spaces here

6:30and then doing some net up here.

6:31Traffic from the Palo Alto going after the real internet

6:34can be great, unless we're trying

6:35to reach these two specific networks of 23.1.2 and 24.1.2

6:40because the Palo Alto firewall is going

6:41to think that those two subnets are local and directly

6:44connected.

6:45But everything else should work with me doing some initial net

6:47here on that traffic before it goes out

6:49to the public, real internet.

6:51And while we're at it, the service provider A,

6:53which is the little VM I have running in my lab,

6:55that little pseudo internet service provider

6:57A is reachable at dot 1 as a next stop address.

7:00And the little pseudo internet provider here for ISP B

7:03is also at one .1.

7:05So 23.1.2.1 and 24.1.2.1.

7:08So next, let's carve out a couple of user subnets.

7:11Let's go and put one here and another one right here.

7:14And for this bottom one on the left here,

7:16let's use the IP address space of 10.10.0.0.

7:20Everything here is going to be with a 24-bit mask, by the way.

7:23And then for the second subnet, let's use 10.20.0.0.

7:27And we'll put some connectivity from the firewall

7:29here to each of those subnets.

7:31And let me go ahead and cap those subnets at the end there.

7:33So in the old days, that'd be like a 50-ohm terminator

7:36on coax cable.

7:37That's like 25 years ago.

7:39Of course, now, this is just a logical representation

7:41of an Ethernet VLAN.

7:42And let's draw a couple hosts.

7:44Put one on each subnet right here.

7:45So a little host here, a little computer there,

7:47and another one right here.

7:48Just represent some type of a client on that network.

7:52And let's also go ahead and put another network right here.

7:54We'll go ahead and draw a connection from the firewall

7:56to that logical network, as well.

7:58And let's imagine that this is the 10.30 address space.

8:02Again, everything here on this topology

8:03will use with a 24-bit mask.

8:05So this segment of the network could

8:07be where we're placing our servers or services that

8:09are going to be made publicly available to internet clients.

8:12So in the old days, that may have been called the DMZ.

8:14Sometimes it still is, or we call this the data center

8:17subnet.

8:18And let's go ahead and put a server or two on that segment.

8:21So there's one.

8:22There's two.

8:23I'll say S1 for server 1 and S2 for server 2.

8:28And we'll put some connectivity there for each of them.

8:31And another server 1 is going to have an IP address of dot 100.

8:34So I'll label that and the 10.30.0 network.

8:36And as we bring another servers, we'll

8:38identify those as we bring them in.

8:40And for these clients down here, they're

8:41going to be DHCP clients.

8:43So in all the Layer 3 interfaces on this Palo Alto firewall

8:46PA-18, we're going to use dot 18 For that fourth and final octet

8:50of the IPv4 address.

8:52So here would be 10.10.0.18.

8:54Over here would be 10.20.0.18.

8:56Here would be 10.30.0.18, et cetera.

8:58Now, for the actual interfaces that we're going to use.

9:01Let's go ahead and use Ethernet 1/1 as the main interface.

9:04We're going to trunk over to our switch.

9:05And then going off to the internet to service provider

9:08A and B and to the two local internal networks into the DMZ.

9:11For those subinterfaces that are supporting these various VLANs,

9:14I would like to actually use the VLAN numbers.

9:16And that way, when I see those interfaces,

9:17I'll know exactly what VLANs they belong to here in my lab.

9:20So the 23.1.2 network is in VLAN-23.

9:23So let's use Ethernet 1/1.23 for that logical interface that

9:28goes to service provider A. And on service provider B,

9:31let's use 1/1.

9:32Same physical parent interface.

9:34Dot.

9:34Let's name it 24.

9:36And that when we see it, we'll know oh,

9:37this is the logical Layer 3 subinterface

9:39that's supporting VLAN-24.

9:41And down, here we use 1/1.30.

9:44And over here, 1/1.10.

9:48And over here, 1/1.20.

9:51So for the zones, let's go ahead and let's

9:53use a zone called outside.

9:55And we'll place both of our ISP interfaces

9:58as members of that outside security zone.

10:00Let's also create a zone called DMZ,

10:02which we can assign an interface like 1/1.32.

10:06And we'll also create a zone called inside.

10:08So let me go ahead and label those.

10:10So the red will be outside.

10:12The yellow, we'll call DMZ.

10:13And the green, we'll call inside.

10:15And as far as which interface is going to which zones,

10:18let's go ahead and put these two interfaces here

10:20into the zone called outside.

10:22We'll put these two interfaces here

10:23that connect to our internal subnets.

10:25We'll put those in the zone called inside.

10:28And then for this interface 1/1.30,

10:30we'll put it in the zone called DMZ.

10:32So I'll just illustrate that right here.

10:34So with this topology in mind, which

10:35these are going to be a winner for us,

10:37we have a few things that we need

10:38to configure in order to get traffic to initially flow

10:40through the firewall.

10:41And that's the point I'd like to get to so that we can actually

10:44use a functional network with the firewall

10:46as we start building and working with the Advanced.

10:48Features on the Palo Alto.

10:50So here's a few things we need to do.

10:51One is we need to initialize the firewall.

10:53So for that, on the firewall, I've

10:54already done a factory reset.

10:56And so it's ready to go.

10:57But we do need a few, basic commands to make it work,

10:59including specifying on the management interface.

11:01And then we go ahead and draw that right here.

11:03Here's our management network.

11:04And here in my lab, that management interface

11:06is going to connect to 192.168.1 network.

11:10And so, again, that management interface address

11:12will be dot 18.

11:13So on the firewall, as part of our tasks here,

11:15we'll need to go ahead and configure the details

11:17for its IP address, default gateway, the mask,

11:20and some DNS, so it can actually interact

11:22with the public internet going out of this interface right

11:24here, the management interface.

11:25Also, here in my lab, I've got a default gateway here at dot 1,

11:29they can go ahead and use to access

11:31the internet through the management interface.

11:32So this will be the management plane.

11:34And for all these other interfaces that are shown here,

11:37those are all going to be part of the data plane.

11:39The next step would be to configure all the other Layer 3

11:41interfaces.

11:42So Layer 3 interface config, which

11:44involves setting up these subinterfaces

11:46and assigning those IP addresses.

11:47And also for the benefit of these clients down here

11:49off the inside, we want to make sure we enable DHCP services.

11:53So we'll make the firewall a DHCP server on ports 1/1.10.

11:57and 1/1.20.

11:59And then for these clients, if they

12:00want to get out through the firewall,

12:02we're going to need to have security policies, at least

12:04enough for them to be allowed the initial flow of traffic

12:06going out to the internet.

12:07We're also going to need some network address translation

12:09to allow traffic as it flows through the firewall

12:12to be sourced and added to either a routable address

12:14or to an interface address here on the outside of the Palo

12:17Alto.

12:18And then finally, we're going to go ahead,

12:19and we want to test and troubleshoot, if necessary.

12:22So a good test would be to take one of these clients

12:24and verify that the client once the firewall

12:26is all configured, that the client can

12:28go out to an internet resource and get a response.

12:31And that would be a great test just

12:32to verify we have the basic components set up correctly

12:35in our topology.

12:36So with that in mind, in our next video,

12:37you and I get to do the basic bootstrap of the firewall

12:40itself.

12:41So I'll see you there in just a moment.

12:42Until then.

12:43I hope this has been informative,

12:45and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06In this video, you and I get to do the basic bootstrapping

0:09of the firewall, including the configuration for the details

0:12regarding its management interface,

0:13and how to reach the internet.

0:15So in our journey, we are right here, initialize the firewall.

0:18I've taken the liberty of doing a factory reset on this Palo

0:20Alto firewall.

0:21And let's take a moment and just confirm

0:23if I've got a console connection going over to this firewall.

0:26So sure enough, it is right where I left it.

0:28So here is the firewall, the PA-440.

0:31I've got the console cable connected to the RJ45 jack

0:34connection on the firewall.

0:36And on my computer, I've got a terminal emulator.

0:38I'm using SecureCRT to connect to this console port.

0:41Also, notice I have not yet connected any cable here

0:44to the management port because, by default,

0:46this bad boy is using 192.168.1.1, which I currently

0:50am already using in my lab.

0:51So we're going to change the management interface

0:53address to 192.168.1.18 and then tell it, the firewall,

0:58to use .1 as its default gateway.

1:01So currently, we are connected to that firewall

1:03that we just hooked up via its console port.

1:05And I've also said yes, I want to stop

1:08the zero-touch provisioning and configure

1:10the firewall in standard mode, and that's

1:12where we are right here.

1:13So we press Enter.

1:14And let's go ahead and log in with the default username

1:16of admin, and I'll put the default password of admin,

1:19and press Enter.

1:20And now it wants me to change that default password.

1:22So I'll put in the old password of admin,

1:24and I'll put it in a new password, press Enter.

1:27I'll confirm the new password I just

1:28set and I'll press Enter again.

1:30[LAUGHTER]

1:32And it's a typo.

1:33All right, let's do it again.

1:34So on the initial password change there,

1:36I must had a typo.

1:37And then when I try to confirm it, it wouldn't let me.

1:39So let me try that again.

1:40Log in as admin, password of admin.

1:42Old password is admin.

1:44New password is-- and I'll do this a little bit slower.

1:46So I put in the new password, press Enter,

1:48and I'll confirm the new password, and press Enter.

1:51Yay.

1:52So now if we do a show system info and press Enter,

1:56so there's the command there.

1:58And it currently is using the management IP

2:00address of 192.168.1.1 and that's what we want to change.

2:04So we'll type in configure to move out of operational mode

2:07into configuration mode.

2:08And from here, what I like to do is go ahead

2:10and use these commands.

2:11Do the initial configuration of the management IP address

2:13to .18, set the default gateway to .1,

2:16and set up a couple of DNS servers with 8888 and 1111.

2:20So I take these commands right here, just right-click,

2:23and copy them.

2:24And then go over here to SecureCRT, right-click, just

2:27confirm the settings.

2:28Those look great.

2:29Click on Paste, and boom, we've just

2:31implemented those four commands, and now we'll

2:33go ahead and do a commit.

2:34So that commit is in progress, moving the candidate

2:37configuration, these commands we just put in

2:39over into the running config.

2:41And it is almost done.

2:44Of course, we could also type in Control C

2:45to return to the command prompt and let

2:47the commit finish in the background.

2:48Either way is great.

2:50All right.

2:50It says it's done.

2:51Let's type in exit to exit configuration mode

2:54and go back to operational mode.

2:55And let's do a show system info one more time,

2:59and now it is using this IP address.

3:01Great, great, great.

3:02Default gateway is .1, which looks great.

3:04And before we call this done, we should

3:06go ahead and test it as well.

3:07So I'm going to take the PA-440.

3:09I'll take a nice long cable and I'll

3:11plug in the management port into my home office network just

3:15to verify that we have connectivity from this PA-440

3:18out to the internet.

3:18And on second thought, I think what

3:20I'll do instead of using a super long cable,

3:22I'm going to go ahead and turn the thing off, move it back

3:25to the rack, and then plug it in there.

3:27And in that way, we can use a shorter cable and that

3:28be the final resting spot for it as well for the duration

3:31of these videos.

3:32So give me a moment right now and I'll go ahead

3:34and place this on the rack.

3:35All right.

3:35So it's now sitting on the rack and it has an Ethernet cable

3:39plugged into the management port that connects to the home

3:41office network.

3:42Also, in preparation for the next video,

3:44I also plugged in to port number 1, Ethernet 1/1.

3:47I plugged in a cable there that goes to a switch

3:49port that is doing trunking.

3:51So these should be the only two physical connections

3:53needed from an Ethernet perspective

3:54for the management and operation of our lab firewall.

3:57All right.

3:58So let's have a moment to go ahead and boot up.

3:59Let's go ahead and verify its basic connectivity.

4:02So once again I'm using SecureCRT

4:03as my terminal emulator.

4:04But this time I'm connecting to the firewall

4:06to its management IP address at 192.168.1.18 using SSH.

4:12And I've logged in successfully.

4:13That's great news.

4:14So let's do a quick test with a ping host,

4:16and let's go to www.paloaltonetworks.com.

4:20And if that works, which it is, I'll do a Control C there,

4:22that verifies that DNS is working.

4:24It also verifies that we can reach paloaltonetworks.com,

4:27which is fantastic.

4:28So we have initialized the firewall, boom, done.

4:31And our next step is to configure

4:33the Layer 3 subinterfaces as shown in our topology.

4:35And then my friend, this is what you and I get

4:37to do in the very next video.

4:39So I'll see you there for that in just a moment.

4:41Until then, I hope this has been informative,

4:43and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06In this video, we're going to continue with our game plan

0:08by implementing layer-3 subinterfaces based

0:11on our topology.

0:12And as a reminder, here are the five interfaces

0:14we're going to be configuring, this one

0:15here for service provider A, service provider B,

0:18one for our DMZ, and a couple for our inside networks.

0:21And again, the number we're going to use

0:23represents the VLAN I'm using in my lab environment.

0:25That way, when I see it, I'll know

0:27exactly what VLAN it belongs to based

0:29on the actual name we give it.

0:30So for my management computer, which is right here at .151

0:33on the management network, let's go ahead and connect

0:35via HTTPS, or the Palo Alto firewall,

0:38and configure those five interfaces.

0:40So we're currently attempting an HTTPS session over

0:43at 192.168.1.18.

0:45My browser doesn't like the signing CA

0:47that signed the cert the firewall is using initially.

0:50That's OK.

0:50We'll fix that in a subsequent set of videos.

0:52But for now, we'll go ahead and click on Proceed.

0:55We'll log in as the user admin.

0:56We'll supply the password we configured

0:58in the previous video, and we'll click on Log In.

1:01All right, welcome to PAN-OS 11, fantastic, so we'll say

1:04don't show that again.

1:05And I don't need to see any of those others

1:07as well, so I'll dismiss those messages.

1:09And with those dismissed, we'll click on Close.

1:12And we'll set up telemetry data collection later,

1:14so we'll click here on Remind Me Later, because our goal

1:17right now is to go ahead and configure

1:19the layer-3 subinterfaces.

1:20So we'll click on the Network tab.

1:22On the left, we'll make sure that Interfaces is selected.

1:25So on this P-440, in this default config,

1:27it has ethernet1/1 as Type Virtual Wire cell.

1:30We're going to fix that.

1:31We're going to click on ethernet1/1,

1:33and I'm going to specify that as a Type of Layer 3,

1:35not because we're going to be using the parent

1:37interface with an IP address, but because we are going

1:39to create logical layer-3 subinterfaces,

1:42so the parent needs to be layer 3.

1:43We'll make that one change.

1:45Click on OK, and then we'll go ahead and make sure

1:47that ethernet1/1 is selected and highlighted.

1:50And then down below, we'll click on Add Subinterface.

1:53I'm going to go ahead and do VLAN 10 first,

1:55so I'm going to name it 10.

1:56And then as far as the 802.1Q Tag,

1:58I'm going to say it's also looking for 10.

2:00And then for the Virtual Router, we don't have anything

2:03except for the default virtual router,

2:04so I'm going to say New Virtual Router.

2:06And let's call our new virtual router R1, as in Router 1,

2:11and we'll click on OK.

2:12And then for the Security Zone that this subinterface

2:15is going to go into, that's going

2:16to be the Inside security zone, which

2:18we don't have yet, so we'll go ahead and click here

2:20on New Zone.

2:20And we'll specify the name of Inside.

2:22We'll click OK.

2:24And then we'll give it an IPv4 address by clicking on the IPv4

2:26subtab, clicking on Add, and this is going to be 10.10.0.18

2:31with a 24-bit mask, just like that.

2:34I also want to specify an interface management profile

2:37so we can have that interface pinged by clients, just

2:39to verify their basic connectivity.

2:41So under the Advanced subtab here in the Management Profile

2:44section, we'll go ahead and use the dropdown,

2:46and we'll click New Management Profile.

2:48And I'm goiong to call this Ping_Only, just like that.

2:50And for Network Services, we'll allow Ping, and click on OK.

2:54And boom, we're done.

2:55We'll click on OK.

2:56So for the other four interfaces,

2:57it's going to be a fairly similar process, except we're

2:59going to swap out the appropriate zone

3:01and the appropriate IP address based on the interface

3:03that we're configuring.

3:04Also, for the intro or fundamentals

3:07regarding configuring interfaces on the Palo Alto firewall,

3:09please check out our PCNSA content

3:12as well for a slightly slower pace.

3:14All right, having said that, let's go do 1/1.20 next.

3:18So we'll make sure that ethernet1/1 is selected,

3:20and then with it selected, we'll click on Add Subinterface.

3:23I'm going to go ahead and name this 20 because it's going

3:26to be supported in the 802.1Q tag of 20.

3:28So I'll put the tag of 20 there, and we're

3:31going to send that to the same virtual router, which is R1.

3:34And this also goes into the inside security zone.

3:37And for its IPv4 address, we'll click on Add,

3:40and it is going to be 10.20.0.18 with a 24-bit mask,

3:44just like that.

3:46And under Advanced tab, we'll go ahead

3:47and use the management profile called Ping_Only

3:50and click on OK.

3:52All right, two down, three to go,

3:53so we'll make sure that 1/1 is still highlighted here

3:57and then click on Add Subinterface right here.

3:59And let's go ahead and do our DMZ next,

4:01and that is going to be identified as ethernet1/1.30,

4:05paying attention to the 802.1Q tag of 30,

4:08assigned to the virtual router called R1.

4:11And the security zone is going to be a DMZ.

4:13It doesn't exist yet, so we'll create it

4:15by clicking here on New Zone.

4:16And we'll call it DMZ and click on OK.

4:19And then click on the IPv4 subtab here and click on Add,

4:23and this is going to be 10.30.0.18 with a 24-bit mask,

4:28just like that.

4:28And then we'll click on the Advanced tab,

4:30and we'll specify we want to have the Ping_Only management

4:33profile used there.

4:35And click on OK.

4:36All right, everything looks great so far.

4:37Let's create two more for our two service providers.

4:40So with 1/1 still highlighted here, down below

4:43we'll click on Add Subinterface.

4:45We'll go ahead and call this one 23 for service provider A,

4:47paying attention to the 802.1Q tag, so VLAN 23.

4:51And the virtual router is going to be our same one, R1.

4:54The security zone is going to be the outside security

4:56zone based on our plan, so we'll click here on New Zone.

4:59And we'll specify Outside and click on OK.

5:03Click on IPv4.

5:04Click on Add for the IP Address, and this

5:06is going to be 23.1.2.18 with a 24-bit mask.

5:10And with that supplied, we'll then go to the Advanced tab,

5:13and we may or may not want to be able to be

5:16pinged from the outside.

5:17In fact, you know what?

5:17I'm going to leave that off.

5:18And that way, if we have devices on the outside that

5:20are trying to ping our IP address on the outside,

5:23there won't be any responses because the management profile

5:25is not going to be allowing ping.

5:26So I'm going to go ahead and leave that part off here,

5:29and we'll click on OK.

5:30All right, one more to go, and that'll

5:32be the interface for our service provider ISP B.

5:35So we'll make sure ethernet1/1 is still highlighted.

5:38Click on Add Subinterface right there,

5:40and we'll call this one 24 because in my lab

5:42it's going to be VLAN 24.

5:43And we'll match on the tag of 24.

5:45So up here, that's just for me, so I remember where it is,

5:48and down here is the actual 802.1Q tag that we're matching

5:51on.

5:52And we'll assign that to the same virtual router, R1,

5:55and we'll also assign that to the outside security zone

5:58by selecting it from the dropdown

6:00there and clicking on it.

6:01And then we'll go to IPv4, click on Add,

6:03and the IP address we're going to give it is 24.1.2.18

6:06with a 24-bit mask.

6:08And then we'll click on Advanced.

6:09And just like ISP A, we're not going

6:11to go ahead and assign it a management

6:12profile for ping or anything else,

6:14so I think we're good there.

6:15We'll click on OK, and let's check our work.

6:18So we have the VLAN 10, VLAN 20, VLAN 30, for the two inside

6:23and the DMZ.

6:24I also want to confirm the zones here,

6:26so I'm going to drag this over so I

6:28can see that right next to it.

6:29So inside, inside, the DMZ, and then we

6:32have 23 and 24 for outside.

6:34And the IP addresses look correct as well,

6:36so let me go ahead and commit this.

6:38And click on Commit again.

6:40Let that cook in the background.

6:41And it's giving me an error about a virtual wire.

6:44Let's take a look at that and fix it right now.

6:45So with Network selected up here on the top, on the left,

6:48let's click on Virtual Wires.

6:49And sure enough, right there, this default-vwire

6:51came with the default configuration,

6:54and it had two interfaces, 1/1, 1/2.

6:56And we changed the type to 1/1, so now it feels hurt.

6:59So what we'll do is we'll fix it by saying goodbye.

7:01So we'll just highlight that default-vwire.

7:03Click on Delete.

7:04Click on Yes, and now it's gone.

7:06Let's go ahead and click on Commit,

7:07and we'll click on Commit again.

7:09And it looks like it's on its way.

7:11So as this commits, our next step

7:13is to configure DHCP services so that clients on the 10/10

7:16subnet or the 10/20 subnet, they can come up,

7:19ask for an IP address, and get one

7:21from the firewall, who's acting as a DHCP server.

7:23So we'll configure that piece in our journey next,

7:25and I'll see you there in just a moment.

7:27Until then, I hope this has been informative,

7:29and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06Based on our plan, we want to enable DHCP services

0:10on the firewall, including support for the 10.10 subnet

0:13and the 10.20 subnet, and that's what you and I get to do right

0:16now.

0:16So we've initialized the firewall.

0:18We've configured the layer three interfaces.

0:19And the DHCP services we want to enable over here on the 1/1.10

0:23subinterface and also the 1/1.20 subinterface.

0:27And for a game plan, let's use the range of dot 51

0:31through 99 on each of those respective subnets.

0:33So with that plan in mind, let's head over to the firewall

0:36and set up DHCP services on those two subinterfaces.

0:39So back at the firewall the previous commit

0:41finished, great, we'll click on Close.

0:43And with network still select at the top on the left,

0:46let's go over to DHCP.

0:47And we'll click on Add to go and add DHCP services.

0:51So we'll click on Add.

0:52And for the first one, let's use interface 1/1.10 to support

0:56subnet 10.

0:57I'll ping before we allocate a new IP address.

0:59And I set a timeout for one day, which

1:01means that the clients have to renew

1:02their lease at least every day.

1:04And

1:04For the range for the subnet 10, let's click on Add.

1:08And let's say the range is 10.10.0.51 based on our plan

1:11all the way through 10.10.0.99.

1:15Looks great.

1:16And we're getting options.

1:17Let's go ahead and specify the default gateway.

1:19It should be the firewall itself, which is at 10.10.0.18.

1:22For the mask we're heading out, it's going to be a 24-bit mask.

1:25For primary DNS, let's use 8.8.8.8.

1:28And for our secondary DNS, let's use 1.1.1.1.

1:31And we'll click on OK.

1:33All right.

1:33Then we'll repeat that for interface 1/1.20 by clicking

1:37on Add.

1:37From the dropdown, we'll choose the right interface

1:39to the dot 20 interface.

1:41We'll do a ping as a check before handing out

1:43a new IP address, which may or may not

1:45be super helpful because a lot of computer like Windows

1:46computers have a firewall in place that

1:48don't respond to a ping.

1:49But for devices that don't, that may help us not

1:52accidentally hand out the same IP

1:53address twice if there's a static address already

1:56in place.

1:56And I'm going to do a timeout, specify a one day lease,

1:59and let's specify the pool range of 10.20.0.51 all the way

2:04through 10.20.0.99 based on our plan.

2:08And for options, the default gateway would be 10.20.0.18

2:12and a 24-bit mask.

2:14And the primary DNS, we'll use 8.8.8.8.

2:17And a secondary DNS, we use 1.1.1.1.

2:19And we'll click on OK.

2:21All right.

2:21Look at the details here.

2:22Those look good.

2:23So we'll go ahead and click on Commit.

2:24And we'll click on Commit again.

2:26Now, once this commit is completed

2:28and it's now part of the running config,

2:29if we bring up clients in VLAN 10 or 20,

2:31they can get an IP address, yes.

2:33They can learn about the default gateway and DNS servers.

2:35But they're not getting up to the internet.

2:37And that's because the firewall has a default policy that

2:40says no for Inter zone traffic.

2:42So in the next video, let's put in a simple security policy

2:45rule that allows those initial flows of traffic from VLAN 10

2:49and VLAN 20 out to the internet.

2:51So I'll see you in the next video for exactly that.

2:53Until then, I hope this has been informative,

2:55and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:07By default, the firewall, if there's

0:09traffic that needs to be forwarded

0:10between two different zones, the answer is no.

0:13We're not going to do it.

0:14So what we need to do is set up a basic, simple security policy

0:17rule that says, you know what, if traffic is trying

0:19to be sourced from a device coming

0:21in to the firewall on the inside zone,

0:22and if that traffic needs to be routed out to the outside zone,

0:25please go ahead and allow that initial flow of traffic to go.

0:29And this can be done through the security policy rule,

0:31and that's what you and I get to do right now.

0:33So here is our commit that was successful from the last video,

0:35fantastic.

0:36And to set up our simple security policy rule,

0:39we're going to click on Policies at the very top.

0:41And on the left, we're going to make sure

0:43that we're selecting Security.

0:44So with Security selected on the left, here

0:46we have rule one that came by default. Let me go ahead

0:48and select that and delete it.

0:50We don't need that.

0:51We'll click on yes.

0:52And let's go ahead and create our own.

0:54So we'll go ahead and click on Add.

0:56And let's call this in2out.

0:59And for the source, we'll specify

1:01the source is going to be traffic entering the firewall

1:03on the inside zone.

1:04And for the destination, it'll be

1:07traffic that's trying to exit out of an interface associated

1:10with the outside zone.

1:11And what we can also do is let's go ahead for source,

1:14let's also throw in some source address information right here.

1:16So we'll click on Add, and let's go ahead

1:18and make a new address group.

1:20And let's call this Internal_Subnets.

1:22And we'll go ahead and click on Add here.

1:24And then I'm going to add a couple new address

1:27objects as part of this group.

1:28So I click right here to do a new address object.

1:31And we'll call this Subnet_10.

1:33And that is going to be the 10.10.0.0 network with a 24-bit

1:36mask, just like that.

1:38And click on OK.

1:39And then we'll add one more new address,

1:42object, and this will be Subnet_20.

1:44And the IP address range there is going to be the 10.20.0.0

1:47network with a 24-bit mask.

1:49And we'll click on OK.

1:50So effectively we're creating three new objects.

1:52Two address objects and one address group

1:54object right in one fell swoop, and we'll click on OK.

1:57So for the source, it's the inside zone

1:59in the IP range of any those two subnets,

2:02and the destination is going out of the outside zone.

2:04And for application, we'll say "any"

2:07and all the application default. We're getting ports,

2:09and we'll click on Actions.

2:10And that's going to be allow.

2:11And we'll leave a log on there, and click on OK.

2:13Also, before we leave our security policy rules,

2:15I want to modify the default behavior regarding

2:18the interzone_default because if it's dropping traffic

2:21by default, it's not talking about it.

2:22It's not logging it.

2:24So I'm going to highlight interzone_default here, click

2:27on the override button right there,

2:28and then for the actions, I want to say, I want to log it.

2:31Now, in a production environment,

2:32you may or may not want to have that logged,

2:34but in a lab environment it's super helpful

2:36when you're trying to troubleshoot why didn't that

2:38get forwarded because the denies based on that default rule

2:42are going to be logged now if we enable this.

2:44So I'm going to click on OK.

2:46So now, with the interzone_default rule

2:48here in the bottom position, if we scroll to the right,

2:50in the column where it says options if we hover there,

2:53it's now showing if we hover over the options here,

2:55this is the icon for logging, meaning that we're now

2:57logging on hits on this rule.

2:59All right, so we'll go ahead and Commit that.

3:01And we'll click on Commit again, and we'll let that complete.

3:04Now, in order for our client's traffic to actually get out

3:06to the internet, besides having permissions

3:08with our security policy role, we're

3:10also going to need to do some network address translation.

3:12So in the next video, let's set up a simple network address

3:15translation rule for source net, so our clients can get out

3:18to the internet.

3:18So we'll do that in the next video, and I'll see you there

3:21in just a moment.

3:22Until then, I hope this has been informative,

3:24and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06In the previous video, we set up a security policy rule

0:09to allow the initial flow of traffic

0:10from clients in our subnets to go out to the internet.

0:13And in this video, we're going to add

0:14on another very important aspect of that,

0:16and that is network address translation

0:18so that the private RFC 1918 addresses that we're currently

0:21using in our network can be swapped out

0:23with globally routable addresses as they

0:25go through the firewall.

0:26So we are right here.

0:27And what we want to do is make sure

0:28that the firewall is going to swap these IP addresses out

0:31as traffic goes out to the internet.

0:33And let's use this interface right here, 1/1.23,

0:37and specify, as traffic goes out that interface sourced from

0:40these clients down here, that that should be swapped out

0:43to whatever the IP address is on this interface.

0:45So at the moment, this 1/1.23 interface is using 23.1.2.18.

0:51So we'll set up source NAT rules to allow that translation

0:54to happen on the initial flows of traffic

0:55from these clients going out to the internet.

0:57So from our previous video, the commit completed successfully.

1:00That's great.

1:01We'll close that.

1:01And with Policies on the top selected, on the left,

1:04we're going to click on NAT to configure our NAT policy rules.

1:08So there aren't any at the moment,

1:09so we'll click on Add right here to add a new rule.

1:12And let's call this SNAT_In-2-Out, just like that.

1:16And we're in the Original Packet.

1:17The considerations are going to be

1:19is traffic that's entering the firewall

1:21on an interface associated with the inside zone.

1:23And it's trying to be routed out of the outside zone.

1:27And for our demonstration and for our lab,

1:29let's use interface 1/1.23, going through service provider

1:33A. And for the source address, let's also lock that down

1:36to our subnets.

1:37So there we have the address group

1:39we created earlier that includes subnet 10 and subnet 20.

1:42So we'll select that.

1:43And then for the translated packet,

1:45we want to do source address translation.

1:47And we're going to do dynamic IP import.

1:49And specifically, we're going to be doing overloading.

1:52A lot of vendors refer to this as port address translation.

1:54So we'll go ahead and specify the interface address.

1:57And then we're going to use interface 1/1.23.

2:01And the interface IP address that's currently sitting there

2:04is this guy.

2:05So potentially, we could map thousands of internal client IP

2:09addresses to this one externally routable address.

2:12So we'll click on OK.

2:13And then we'll click on Commit to go ahead and move

2:16that from the candidate configuration

2:17over into the running config.

2:19Now, one of the challenges with the two policies we just

2:22created, the security policy and also the NAT policy,

2:24is that the firewall at this moment has no desire to forward

2:28packets out a certain direction because it does not have

2:31a route, a default route, that says, hey,

2:33use service provider A. So in the next video,

2:36let's fix that by adding a static default route that tells

2:39the firewall, hey, if you need to forward a packet and you

2:41don't have a more specific route in your routing table,

2:44forward it to service provider A using the next type of service

2:47provider A, which in our topology is going to be

2:4923.1..2.1.

2:51So in the next video, join me as we implement a default route

2:54on the firewall.

2:54So I'll see you there in just a moment.

2:56Until then, I hope this has been informative,

2:58and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:07In this video, you and I are going

0:09to configure a static default route on the firewall.

0:12So in our steps, we are right here.

0:14We'll put in routing, very important.

0:16So we've already done the initialization, Layer 3

0:18interfaces, DHCP server, security policy,

0:21the NAT policy, and now we're going

0:22to set up the default route.

0:24And the reason this is so important is

0:25because if a client here, let's say we have a client

0:27at 10.10.0.60 and it wants to forward a packet out

0:31to the internet, the security policy says yep,

0:33please allow it to happen.

0:34The network address translation swaps out the source address

0:37with this one through service provider A,

0:39but the firewall itself won't even

0:41try to forward it out to the internet

0:43unless it has a default route that says

0:45that's the way it should go.

0:46So what we get to do right now is configure a static default

0:49route on the Palo Alto that says,

0:50hey, listen, if you don't have a more specific route to whatever

0:53the destination IP address is the client is trying to reach,

0:56go ahead and use the default route, which

0:58is going to use service provider A with the service provider

1:01A next hop of 23.1.2.1.

1:04So that's what we're going to configure right now.

1:06So to configure the default route

1:08we're going to go to Network.

1:10And with network selected over on the left,

1:12we're going to go down to Virtual Routers.

1:14And I've got the default virtual router which we're not using,

1:17so I'm going to go and select it and delete it.

1:19Goodbye.

1:20And click on Yes.

1:21So currently our virtual router R1

1:23has these five logical Layer 3 interfaces associated with it.

1:27And as a result, if we clicked right here on More Runtime

1:29Stats, and I'll scooch this over just a little bit,

1:32and we went to the Forwarding Table--

1:33[LAUGHTER]

1:36--what we should see is we should

1:38see directly connected networks associated with each

1:41of those five interfaces.

1:42But I don't see any, so let me go ahead

1:44and close that for a moment.

1:45And let's go back to Interfaces, and that's

1:48because this interface is down.

1:50I must not have plugged it in.

1:51I thought I did.

1:52Let me take just a moment and physically plug ethernet1/1

1:55into the physical switch where it's currently doing trunking.

1:59I'll be right back.

2:00So I just moved the physical cable

2:02over to the correct port, 1/1.

2:04Let me click on a refresh right here,

2:05and that looks much better.

2:07Now, if we go back to Virtual Routers,

2:10so now if we click here on More Runtime Stats,

2:13we should see here in the route table

2:15that each of those networks are showing up

2:17as directly connected.

2:18So those are these flag of C represents here.

2:20The C represents directly connected.

2:23So the 10.10 up ethernet1/1.10 and the 10.20 network up

2:28ethernet1/1.20, and so forth.

2:30So the route table is everything that the firewall knows about,

2:33and then the forwarding table is actually what's being used.

2:36Sometimes we have multiple routes to the same destination

2:38and it may prefer one over the other.

2:40And so the actual winner's table is the forwarding table

2:43right here.

2:43So if we look at this list here, if we scroll up and down--

2:46in fact, we can make a little bit taller here,

2:48there is no default route.

2:49So this firewall only knows how to reach these networks right

2:52now.

2:53It doesn't know how to reach the rest of the internet.

2:54So what we're going to do is we are

2:56going to configure a static default route,

2:58and it goes something like this.

2:59We'll go into the details of router 1, our virtual router

3:02by clicking on it.

3:03And then on the left, we'll click on Static Routes.

3:06And what we'll do is we'll create a new IPv4 static route

3:08by clicking on Add and we'll call this Default_Via_ISPSA

3:13because that's what it's going to be.

3:15And here's the syntax for a default route, 0.0.0.0-0.

3:20So we can either just put it in here

3:21or we can make an address object that represents that.

3:24Let me go ahead and just leave it like that.

3:26And the interface we want to use is the one going out

3:28through service provider A. Let's

3:30take a peek at that real quick.

3:31So that is this interface right here, 1/1.23,

3:35and it's got a next hop address, that's the ISPA's next hop

3:38address of .1 on the 23.1.2 network.

3:41So with that in mind, let's go back

3:43to the interface on the firewall.

3:44So from the dropdown, we go to Interface.

3:46we're going to use 1/1.23, and the next hop IP address is what

3:51we want to use and that next hop IP address is 23.1.2.1.

3:56And then for the IP address, we can actually

3:57put in the IP address here or we can create an address

4:00object that represents that.

4:01In fact, let's do that.

4:02Let's call it ISPA_Next_Hop.

4:04And then for the IP address, it's going to be 23.1.2.1,

4:08and then we'll click on OK.

4:09And then we'll click on OK.

4:11So now we have a default route or at least we will

4:13once we commit this.

4:14So we'll go ahead and click on OK,

4:16and then we'll click on Commit, and commit one more time.

4:19Now, before we leave this video, let

4:20me go ahead and let that commit happen in the background.

4:23We want to test and verify that the default route on the data

4:26plane is actually working.

4:27Now one option that we could do is

4:30we could go to Device, and then on the left,

4:33we can go down to Troubleshooting.

4:34And with troubleshooting selected-- so here

4:36for our test configuration we could say let's do a ping.

4:39And for the source, let's specify 23.1.2.18,

4:43that's our IP address over on our ethernet1/1.23 interface.

4:48And for the destination, let's go ahead and ping 8.8.8.8.

4:51And we'll click on Execute.

4:53So it says running test.

4:54And if we click on the result, it is successful.

4:57Now, the reason it's important to source it

4:59from this interface is because if we didn't source it

5:02from the actual data plane interface,

5:04it would by default try to source this from its management

5:07interface.

5:08And so you want to make sure that when we're

5:10testing our connectivity, if you're trying to test the data

5:12plane default route, make sure you're

5:14sourcing it from a data plane interface.

5:16Another option would be right here

5:17at the command line with a ping and a question mark.

5:20And I'm going to put in a source and a question mark.

5:23And we can put in 23.1.2.18, and then host 8.8.8.8,

5:29and press Enter.

5:30And also we can see that is succeeding

5:32Another cool option to confirm is using a traceroute.

5:34So if we do a traceroute and we've got a new traceroute

5:37host 8.8.8.8 and press Enter.

5:39By default here, it's using the management interface

5:42and the next hop is the default gateway associated

5:44with the management interface.

5:45That's not using the data plane.

5:47But we did the traceroute again and we

5:49go ahead and add the source.

5:50So do the source 23.1.2.18 with the host of 8.8.8.8

5:55as the destination, press Enter.

5:57Now we can see the first hop is 23.1.2.1,

5:59which is going through service provider A,

6:01and then it's back calling to my home network

6:03and then off to my real ISP and onto the rest of the internet.

6:06So just be aware, when you're testing the default route

6:09on the data plane, make sure you're testing it

6:11from the data plane and not from your management interface,

6:13which is the default.

6:14So let's do a quick review of what we've configured.

6:16We've configured our Layer 3 interfaces or subinterfaces.

6:19And as part of that, we set up our zones

6:21and our virtual routing.

6:23Also, included as part of that is a default route

6:26so we get a more runtime stats and forwarding table.

6:28There's our default route right there.

6:30We also set up our policies, including our security policy

6:33to allow that initial flow of traffic in and out.

6:36We also set up a basic NAT policy for source NAT

6:39for that same flow of traffic.

6:40And our last step, I suppose, is just to assume it all works.

6:43Or we could bring up a client or two on those subnets

6:47and actually verify that they can get traffic out

6:49to the internet and get responses back,

6:51which is exactly what you and I get

6:52to do in the very next video.

6:54So I'll see you there in just a moment.

6:55Until then, I hope this has been informative,

6:58and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06In this video, we're going to do a basic test

0:08of our infrastructure for our lab

0:10by bringing up a couple of clients, one in VLAN-10 and one

0:12VLAN-20, and verifying that they can access resources out

0:16on the internet.

0:17So in my lab environment, I've got on my ESXi VMware host.

0:21I've got a couple of VMs or a few VMs in VLAN-10 and VLAN-20.

0:24Let's go pick one from each of those VLANs

0:26and bring them up so we can test connectivity out

0:29to the internet going through our newly configured firewall.

0:32So here's the graphical user interface

0:34for directly connecting to an ESXi host.

0:37And let's go down to Networking.

0:39And let me go to VLAN IDs.

0:41And let me pick on VLAN-10.

0:42And we just see who's connected there.

0:44So here on VLAN-10, let's go ahead and grab this guy right

0:47here, Linux for Palo Alto.

0:49I'll click on it.

0:49And it is in VLAN-10, the source network interface card is.

0:52And let's go and power that on.

0:54And while that power is on, let's

0:56go down to Networking once again.

0:58And let's go down to VLAN-20.

1:00And let's pick a machine from there.

1:02So here, I have a machine called Windows 11 VLAN-20 in Domain.

1:06Let's go ahead and click on that.

1:07Confirm it's really in VLAN-20.

1:09It is.

1:09And we'll power that on, as well.

1:11So this represents a Linux machine here on VLAN-10

1:14on the 10.10 network, and a Windows computer here

1:17on VLAN-20, which is running the 10.20 address space.

1:20And the Palo Alto firewall is acting as a DHCP server.

1:23So each of those clients should be

1:25able to get an IP address via DHCP from the Palo Alto.

1:28So back at the firewall, if we go to the Network tab on top

1:31and we go down on the left to DHCP,

1:34for both of these interfaces for VLAN 10 and 20, respectively,

1:37if we click here on View Allocation,

1:39this shows that the Linux machine

1:42has an IP address at dot 56.

1:43Fantastic.

1:44We'll close that.

1:44And for the other interface, we'll click on View Allocation

1:47right here.

1:48And this one does not.

1:50That's my Windows machine.

1:51It could be that Windows machine is taking a little bit longer

1:53to boot up.

1:54So let's go ahead and start with the Linux computer,

1:57which got its IP address via DHCP already.

1:59So this represents that Linux computer right here.

2:03And just to confirm, let's bring up a command prompt.

2:06And let's do an ifconfig on this Linux computer.

2:08Sure enough, 10.10.0.56.

2:10And let's just try a ping out to the internet at 8.8.8.8.

2:15I just get a chuckle when it works the first time.

2:17There's a few moving parts here, and that seems to be working.

2:20Let's go ahead and close that.

2:22And let's open up a browser here on this little computer

2:25right here.

2:26So let's make a road trip out to YouTube.

2:28And YouTube seems to be working great.

2:30All right.

2:31So we've just verified that a computer sitting here

2:33on the 10.10 subnetwork can access the internet

2:36successfully, going through the firewall.

2:38And let's do the same thing by testing the computer over here

2:40on VLAN-20.

2:41And so for the Windows computer on VLAN-20,

2:44let me bring it in and 10.20.0.105.

2:48That's our range.

2:49Oh, I believe this is statically configured.

2:51Let's take a quick peek.

2:52So I'm going to open up the Network Control Panel,

2:54and we'll right-click and go to Properties.

2:57We've got IPv4.

2:58Oh, yeah, sure enough.

2:59So it has a statically configured IP address

3:0210.20.0.105.

3:03And it has a default gateway of dot 18, which

3:06is back here at the firewall.

3:08So it looks OK.

3:08So we'll go ahead and close that and close that.

3:11And let's bring up a command prompt and do some testing.

3:13So we'll do a ping out to 8.8.8.8.

3:16And that seems to be working great.

3:18And let's open up a browser.

3:20So we'll open up a browser.

3:21Again, this is from a client over here on the 10.20 subnet.

3:25And let's go to fast.com.

3:27That's from Netflix.

3:28And that seems to be doing pretty well.

3:32And that's traffic from this little Windows computer going

3:34through the firewall, through a few layers of net here out

3:37to the internet.

3:38And it shows 650 megabits per second internet

3:41speed that's for download.

3:42Not bad.

3:43So the last thing I want to do here

3:44is take all this beautiful work that we've done,

3:46and I want to save it.

3:47So I'm going to click here on Device.

3:49On the left, we'll go over to Setup.

3:51And then we'll go to Operations.

3:53And I want to save a named configuration snapshot.

3:56So we'll click here and save name configuration snapshot.

3:58And I'm going to call this Base_LAB_0201

4:02because that's the date today.

4:03And then I'll go ahead and click on OK.

4:05That way, if we ever need to restore back to this point,

4:07we can.

4:07So click on Close.

4:09Also on here, I'm going to download that

4:10to my local computer by clicking on Export named configuration

4:13snapshot.

4:14And from the dropdown, choosing that snapshot we just made.

4:17And then clicking OK to download that to my local management

4:20computer.

4:21So in this set of videos, we've done two basic things.

4:24Number 1, we've gone through a lot

4:25of the fundamentals regarding the configuration

4:27of the basic elements of a Palo Alto firewall.

4:30And secondly, we've put together a beautiful foundation

4:33on which we can build upon as we start

4:35working with the more advanced features of the Palo Alto

4:37firewall.

4:38So thanks again for joining me in this set of videos,

4:40and I'll see you, my friend, in another set very, very soon.

4:43Until then.

4:44I hope this has been informative,

4:46and I'd like to thank you for viewing.