{"id":4287,"date":"2024-11-15T11:30:06","date_gmt":"2024-11-15T11:30:06","guid":{"rendered":"https:\/\/geekmungus.co.uk\/?p=4287"},"modified":"2024-11-15T11:32:54","modified_gmt":"2024-11-15T11:32:54","slug":"palo-alto-firewall-command-line-example-interface-and-access-rules","status":"publish","type":"post","link":"https:\/\/geekmungus.co.uk\/?p=4287","title":{"rendered":"Palo Alto Firewall &#8211; Command Line Example (Interface and Access Rules)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The Palo Alto Firewall GUI is really slick, but sometimes its handy to create using the CLI, perhaps if you have a large number of changes that need to be made at once. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Within this example, we&#8217;ll create a zone, then an Interface (on an Aggregate Interface), give it an IP address, apply a management profile, and then enable a DHCP Helper (Relay); once that is done we&#8217;ll then create some access rules (not for use in production) which allow all traffic in and out of the zone.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When using Palo Alto CLI you can view the output in different forms, personally I like the &#8220;set&#8221; format, which can be activated upon your session with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>set cli config-output-format set<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To create the Zone, Interface, Management Profile and DHCP Helper, you can use the following:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>set zone SuperSecure\n\nset network interface aggregate-ethernet ae2 layer3 units ae2.500 tag 500\n \nset zone SuperSecure network layer3 ae2.500\n \nset network virtual-router Trust-VR interface ae2.500\n \nset network interface aggregate-ethernet ae2 layer3 units ae2.500 ip 192.168.10.1\/24\n \nset tag SuperSecure color color3\n \nset network interface aggregate-ethernet ae2 layer3 units ae2.500 interface-management-profile Ping\n \nset network interface aggregate-ethernet ae2 layer3 units ae2.500 comment \"Super Secure VLAN\"\n \nset network dhcp interface ae2.500 relay ip server &#91; 192.168.1.10 ] enabled yes<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Once your zone and interfaces are created you can then create the rule-set, firstly the Inbound then the Outbound:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>set rulebase security rules Internal_to_SuperSecure_Allow_In_All from Trust-Internal to SuperSecure source any destination any application any service any action allow\n\nset rulebase security rules Internal_to_SuperSecure_Deny_In_All from Trust-Internal to SuperSecure source any destination any application any service any action deny log-setting \"Log to splunk\" tag DENY<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>set rulebase security rules SuperSecure_to_Internal_Allow_In_All from Trust-Internal to SuperSecure source any destination any application any service any action allow\n\nset rulebase security rules SuperSecure_to_Internal_Deny_In_All from Trust-Internal to SuperSecure source any destination any application any service any action deny log-setting \"Log to splunk\" tag DENY<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Hopefully that overview is helpful, the command line can be a little odd at times, and if you are using Virtual Systems, it can make things more complicated.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-wp-embed is-provider-the-geek-stuff wp-block-embed-the-geek-stuff\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"wp-embedded-content\" data-secret=\"VWbP9soYv3\"><a href=\"https:\/\/www.thegeekstuff.com\/2019\/06\/paloalto-cli-security-nat-policy\/\">15 PaloAlto CLI Examples to Manage Security and NAT Policies<\/a><\/blockquote><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; visibility: hidden;\" title=\"&#8220;15 PaloAlto CLI Examples to Manage Security and NAT Policies&#8221; &#8212; The Geek Stuff\" src=\"https:\/\/www.thegeekstuff.com\/2019\/06\/paloalto-cli-security-nat-policy\/embed\/#?secret=jXATXozs6j#?secret=VWbP9soYv3\" data-secret=\"VWbP9soYv3\" width=\"600\" height=\"338\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe>\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>The Palo Alto Firewall GUI is really slick, but sometimes its handy to create using the CLI, perhaps if you have a large number of changes that need to be made at once. Within this example, we&#8217;ll create a zone, then an Interface (on an Aggregate Interface), give it an IP address, apply a management &#8230; <a title=\"Palo Alto Firewall &#8211; Command Line Example (Interface and Access Rules)\" class=\"read-more\" href=\"https:\/\/geekmungus.co.uk\/?p=4287\" aria-label=\"Read more about Palo Alto Firewall &#8211; Command Line Example (Interface and Access Rules)\">Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":4289,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[],"class_list":["post-4287","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-palo-alto-firewall"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4287","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4287"}],"version-history":[{"count":1,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4287\/revisions"}],"predecessor-version":[{"id":4288,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4287\/revisions\/4288"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/media\/4289"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}