Hi, this is time to Palo Alto Network Community. This is the first episode of our getting started guide, I've Unpacked My Firewall, Now What? We're going to take a look at which options are available to connect to the firewall's management for the first time, how we can set up licenses, how we can download software and content, and how we can prepare our security policy for the first time? Before we can get started, we'll first need to connect our management station to the firewall. There are two options available. The first is a management port, which is going to use a normal IP address for configuration, or we can use a DB9 to Internet console cable to connect to the console ports. If we move over to my workstation, we'll take a look at how we can connect. If we open up PuTTY and select Serial, you'll see we're going to Login Prompt, where you can log in using the default username password Admin. Admin. From here we can go into Configuration Mode and add configuration to set the IP address of the device. But, I'll show you how to do that through the Web interface, which is a little easier. We'll first need to change the IP address of our workstation. Because the firewall is going to have a factory IP address of 192.168.1.1. We need to set our interface to match that IP range, so we can connect to the interface. We'll take dot two. The subnet mask doesn't really matter. We don't need a DNS right now. So, go ahead, Okay. Okay. If we now open up a browser HTTPS 192.168.1.1. We'll first get a certificate warning message because the SSL connection to the Web interface has been signed by a self-signed certificate. So, your browser is going to pop up a little complaint, which you can safely ignore because you know that the device is safe, you've just unpacked it. So, there's no need to worry. Again, we're going to log-in with Admin, Admin. We'll see that there's a little warning telling you that the device still has a default username and password. So, it's advisable to change that later. Now, we're in the dashboard. From here, we're going to go to the Device tab, access the Setup, and then in the Management Interface Settings, we're going to change 192.168 to an appropriate IP address in my network. So, in my case, it's going to be 10.0.0.5. Subnet mask is fine. The default gateway for my network, it's going to be 10.0.0.1. This may be a little different than yours. So, take note. Going to click Okay. Then, we're going to go to Services, where we are going to add a DNS Server, 4.2.2.2, for example. Then, we are going to Commit this Configuration and change the IP address. While this is committing, we're going to change the IP address of our workstation. Because, as soon as the commit is finished, the IP address of the firewall is going to be changed as well, so we will need to connect to a new IP address. We're going to go back here, back to my interface. We're going to change this 10.0.0.4, for example. We can still use our console connection from earlier to take a look at the Commit status. Show Jobs All, and we'll see that the Commit is nearly done, 99 percent. Commit is finished. So, now we're going to go over here in our browser, and we're going to connect to the new IP address. We get the same error message from earlier, because this is now a new IP address we're connecting to. I'm going to log in again. Now, we're ready for the next step. First thing we're going to do is activate the licenses. So, we navigate to the Device tab. We're going to scroll down to the Licenses. Now, here you have several options available. You can manually upload the license key. You can activate a feature by using an authorization code that you've received from your sales contact, or you can retrieve licenses from a licensing server. If you've activated your firewall and activated all your licenses through the support portal, the only thing you'll need to do here is to retrieve licenses and the device will go out and to fetch everything it needs. So, we're going to go ahead and do this. Okay, so, now my device is hold to licenses, and we can proceed to update the content and the software. First thing we're going to do is go to Dynamic Updates. You'll see that there's not much in here. So, first thing we'll need to do is get a new list of available content that you can use to update the system. Once that it had been fetched, we're going to go ahead and download the content package, and once it's downloaded, we can go ahead and install it. Once the very first apps and threats package is installed, you might see an error message that the previous content package couldn't be saved, which is because the previous content package is the factory one. So, this doesn't really matter that much. The next one should have no problems at all. Once this is done, you can go back to the update page and check again. Now, we should get an antivirus package as well. As you can see, you now have an antivirus package. We're going to go ahead and download that. Then, after it's been downloaded, we're going to go ahead and install it. Now, this is completed, this is a good opportunity to set a schedule. Setting a schedule will ensure that your system is up to date at all times. So, first, we're going to go set an hourly update for download and install for the antivirus, which means every hour, it's going to check if a new package is available, download it and install it. The application and tricks is already set to download only every Wednesday by default. We're going to change that to be daily regimen and set that at 2:00 in the morning, download and install. Okay. Then, we'll go ahead and commit this. Now, this is completed. The final step is to upgrade the software of the system itself. So, we are going to close this. I'm going to go to software. When you access the software the very first time, you will see this message pop-up. It's basically, because the system is never docked to the update server that it isn't aware of which software packages are available. You can go ahead and close this and check now. Now, it's going to contact the update server and get a full list of available software that it is allowed to download, and we'll see that currently, we have 701 installed and the latest version available to me is 703. You'll notice that for me, this version is already downloaded, so you might need to download that first. We're going to go ahead and install this version. Now that the software installation is complete, we're going to go ahead and reboot the firewall. After the reboot completes, we end up on the login page. So, we're going to login again, admin, admin. Then, we're going to take a look at some security profiles. Under the Objects tab, we have our security profiles where most of these have been preloaded with the default profile. We are going to leave this for now, but we are going to create a new URL filtering profile because the default one is not going to be logging a lot of actions. So, to show what kind of logging we can get in the later series, we're going to enable logging on all your categories, so you can get a nice clean log. There's an option to set all actions to alert. This will create a log entry for each time a URL in any category is accessed. Next, we're going to take a look at the applications. Scroll up again, applications. There's a full list of all the applications we can identify right now, there's 2,275. That's a lot of stuff we can use to build policies. We're going to be using an application filter. This is a sort of dynamic group that allows you to choose based on behavioral properties, what kind of group this is going to be. So, as an example, we're going to start off with a peer-to-peer file sharing group which will contain all kinds of typically unwanted file sharing protocols you can see in an organization that we want to block. We will name it peer-to-peer, then go to our security policies and create a new rule or the source is going to be our trust zone. The destination zone is going to be untrust which will be the outside the application. We're going to take our peer-to-peer group. The easiest way to find this is by typing the name. Then, the actions, we're going to set the action to deny. We need to make sure the peer-to-peer role is stationed above our original rule. One, because else peer-to-peer applications might not get blocked. The security policy is processed top to bottom. So, the first rule that matches will be used. If the rule one had remained at the top, which is an allow any rule, there's no application, there's no filtering for anything, it just allows all traffic through, we won't be blocking anything. To shed a little light on the trust and untrust zones, we can go to the Network tab. We can see that there are currently two interfaces configured as virtual wire. The virtual wire functions as a bump in the wire, so there's no configuration needed. There's no layer three, there's no IP addresses, there's no violent act nothing. We only need to make sure that the interfaces are connected to your network. The interface one is currently configured as the untrust interface and interface two is currently your trusted interface. Which means that interface one should get connected to your router or your upstream routing device, and your interface two should be connected to your switch where all your hosts are located. This will make sure that our security policy makes sense because any connections coming from your hosts going out to the internet would come from trust, it will go to untrust, and anything coming in from the Internet will come from zone untrust going to your trust zone. The last part we are going to be doing is we are going to go back to the security policies. We're going to open rule one which is currently an open security policy, which is going to allow everything. There's no applications and no services configured, so it's going to allow everything, but we are going to enable some security profiles, so all your outbound connections are secured. We're going to be taking all the default profiles we saw earlier except for Euro filtering where we're going to take our custom profile so that we can see Euro filtering logs at a later stage. Once this is done, go ahead and commit. Now, you're ready to start using your firewall. Go ahead and connect your router to the untrust interface and you're switch to the trust interface. Now, your network topology should look like this. Interface one connected to the router, interface two connected to the switch and your management interface also connected to your switch. I hope you enjoyed this video. Feel free to leave any comments in the comment section below. Thank you.
