Building a Palo Alto Firewall Lab in ESXi

0:00[AUDIO LOGO] Hello, and welcome. My name is Keith Barker, and if we look at the recipe and all the ingredients for getting really good at something, one of those key ingredients is going to be hands-on practice. So in this set of videos, here's what I'd love to do. I'd love to chat with you about a few options for building a home-office lab so you can build one and then actually get hands-on practice with the Palo Alto Firewall. And then let's put a game plan together, and I'll walk you through step by step with one example of building such a lab in this set of videos.

0:34So if you're ready, I'm ready. I'll see you, my friend, in the very next video for the big-picture overview of building our lab.

0:06In this video, you and I get to take a big picture look at a few of our options regarding creating a lab environment so we can get hands-on practice. And the two big options we have regarding getting hands on practice is use physical gear. So in the old days, they had this little, teeny baby bear unit called the PA-200, that's end of life, and then they came out with a PA-220, and that was OK. It was all right. It took maybe five or six minutes to do a commit sometimes, and if we rebooted it, it might take 15 minutes. Now, the good news, as of 2023, the PA-220 is now end of life, and so they have a PA-400 series, and the model I specifically like for a lab unit is the 440.

0:43There's a 410, but it doesn't do local logging, so if you want logging, if that's important to you in a lab environment, you definitely want to go ahead and get the PA-440. So you'd purchase the hardware, and also, they have a lab license that's good for one year to give you all the bells and whistles and features on the next generation firewall. So this is the PA-220 unit. There's the transformer. It plugs in on the back, and here's the front side of the PA-220. So with the PA-220, it was good in this day, but again, it takes a while for a commit, so it takes longer to reboot.

1:13And so the new models, the 400s, are a great answer for a home lab environment. So I've got a couple coming in, and once they arrive, I'll show those to you on camera as well. Now, in addition to the hardware, you also need to purchase an A license. So there's a special lab license that goes with the PA 400 series, and it's good for a year. So you want to have the hardware in place and also the lab license so you can use and practice with the features. Now, in the event that you have, either a physical appliance, but you don't have the license, there are still about 30% to 40% of the hands-on practice you can get even on a device that doesn't have a license for the next generation firewall.

1:49And that way, you can practice the basics like setting up permissions and security policies and address translation and routing, and so forth. However, without the license in place, you won't be able to do the advanced firewall features, such as things like threat prevention and antivirus and anti-malware and so forth. So now, let's turn our attention from physical gear to our options, regarding virtual. And there's a few options here. One is we could go ahead and we could rent the actual services of a Palo Alto firewall in the cloud, with a pay-as-you-go model, which is one of the options for our cloud providers, including from AWS.

2:23So in AWS, Amazon Web Services, we could go there, go to the marketplace, and actually, rent a virtual machine in AWS that we could use as our firewall. And let me show you what that looks like. So this is AWS Marketplace. I'm currently logged in to AWS, and in AWS Marketplace, we can do a search for Palo, press Enter, and there's a whole bunch of options regarding Palo Alto services. So here's one for Panorama. This one right here is the VM series next-generation firewall, BYOL, that's bring your own license, or you can purchase bundle 2, or bundle 3, and that has a license included in it.

2:59You're basically renting the services, including the license services through the VM, and they have a 15-day free trial if you want to set that up. However, I will warn you that if you have absolutely zero experience with AWS and security groups and connectivity, there may be a slight learning curve on the AWS side of it to get full access and functionality into your virtual machine. However, if you do have some AWS experience, it's a fantastic option for spitting up a firewall up in the cloud at AWS. Another option would be to spin up the firewall as a virtual machine on prem.

3:31So we could use something like VMware's ESXi, or if you use VMware's Fusion or VMware Workstation or a hypervisor from Microsoft, such as hyper-v, or you can even use tools like EVE-NG and GNS3. But once again, just remember that if you don't have the actual licenses for the VM, you can still get the VM up and running and set up the basic functionality for a stateful firewall. However, you won't be able to practice with any of the advanced features such as threat prevention and antivirus and anti-malware and so forth.

4:01So if we're going to implement the firewall as a VM in our lab environment, one of those options, as I mentioned, is use a VMware products, including ESXi. So let me clear this up, and let's do a rough draft regarding what a lab environment can look like leveraging ESXi. So let's imagine that this represents the ESXi host, a physical piece of hardware that's running the ESXi hypervisor from VMware. So I'll go ahead and label that, ESXi. And currently, behind me in my rack, I've got a few Dell server blades, which are all running ESXi.

4:33So we could place the Palo Alto firewall as a VM that's running inside of the ESXi hypervisor. Now, the question may be, well, if we're running this firewall as a VM, how does it interact with the rest of the world, and how do we actually make it perform like a traditional firewall would? Because at the moment, it's just stuck inside of this ESXi hypervisor. So here is the solution to that. What we can do is we can have some switches, some virtual switches inside of our hypervisor. So I'm going to go ahead and draw two of them, and I'm going to call this switch right here the management switch, which is going to be supporting our untagged traffic.

5:04Think of it like VLAN 1, the native VLAN. And over here, let's go ahead and use another virtual switch and make it our trunk switch. So anything that we're connecting to the trunk can support 802.1Q tags. So in an ESXi environment with virtual switches, each of the switches can have one or more port groups. And so here's the little port group right there. I'll put that in blue. I'll put another little port group right here in pink. I'll put another little port group here in green. And we can associate each of these port groups with a separate VLAN. So I'll have this little blue port group associated with VLAN 10, and I'll have the little pink port group here associated with VLAN 20.

5:39And for grins, I'll take this third one, and I'll make it associated with VLAN 30. So if we have VMs like this firewall or any other VMs that are running and we want them to have connectivity into VLAN 10 or 20 or 30, we can simply connect them to the respective port group. And over here, I've got one giant port group that represents, effectively, VLAN 1, the native VLAN with no 802.1Q tracking. So if we want to have connectivity between our firewall and VLAN 10, we can go ahead and take one of its logical network interface cards-- let's go and take the virtual NIC 1/1, and logically associate it with this port group right here, and boom, it's now directly connected to VLAN 10 off that 1/1 interface.

6:17We can do it also with another interface. Let's take 1/2, and we get associate that over here with the port group that's supporting VLAN 20. And the same thing for 1/3, we can go ahead and logically associate that with the port group associated with VLAN 30, and then this firewall is now directly connected to each of those three VLANs. And let me also create another port group right here, and I'll go ahead and say this one is associated with VLAN 23. In my lab environment, I'm using VLAN 23 as a logical connection to the internet.

6:47So if we wanted this firewall to have connectivity to that VLAN as well, we could take another interface. Let's go ahead and use 1/6. And we can associate that with this port group, and boom, now, we have connectivity to these three VLANs, which could be internal networks or maybe two internal networks and a DMZ as well as the VLAN that leads out to our service provider for outside access. Also, on the firewalls, they're also going to have a ethernet management interface. So on a physical firewall, that would be a physical port, and on a virtual machine, it'd be a logical port being used for management. And if we want to manage this firewall, let's say we want to manage it from our management network, we can go ahead and take that management interface and connect it over here, associate with a port group that's connected to our management network.

7:27So if we have some clients, let's imagine we have a Linux client, we can go ahead and associate its network interface card with this port group, which would put it also into VLAN 10. And if we have a Windows computer right there, we could associate this network interface card with VLAN 20, that port group, and any traffic from these clients going out to the internet would have to go through the firewall in order to get there, which would also require us to set up the appropriate network address translation and permissions and security policies here at the firewall. Now, as far is really getting to the internet, I've also got a little router-- I'll go ahead and label it R right here for router.

8:02And that little virtual router is connected to VLAN 23 as well. So this is acting as our ISP, and its IP address is 23.1.2.1. That's connected back to this network. So my management network is 192.168.1.0, and I've got a physical router on my network here at 192.168.1.1. So the question may be, well, how does this little virtual router in your network, that's at 23.1.2.1, how does it actually get out to the real internet through this router? So we'll call this guy R1, and I'll call this guy R2.

8:34And the secret to that is I've got connectivity between this virtual switch here in my ESXi environment out to a physical switch. And this network interface here is one of the physical interfaces on the ESXi host that's logically connected to this management switch inside and physically connected through its physical interface to a physical switch on the outside. So it's connected here on a physical port. I also have my real router also on that same switch, and then this router has another connection out to the public internet. So from the firewall's perspective, it just thinks that, hey, it's the default route, and it's the next hop of 23.1.2.1 will get me there.

9:08This router is actually doing a little bit of network address translation trickery, forwarding it over to the 192.168.1 network, with the next hop of 192.168.1.1. And then this router is also doing address translation before forwarding that traffic out to the public internet. So there's a couple of layers of net here that's happening behind the scenes, but it's all to provide an environment that looks and feels just like a normal network would. With clients in separate VLANs, the firewall being the default gateway for those clients, then having the firewall policies and the routing and the net and everything else set up here at the firewall to allow that traffic to go out to the internet.

9:43So effectively here at this router, we're doing port address translation to whatever its egress or outbound interface is, and we're also doing PAT here at this router, router 2, swapping out the source IP addresses that are coming in with whatever the egress interface address is here on this router. So this is the nuts and bolts of how the physical connections are in place, but I also think it would be effective to take look at the logical topology that's in place once we put this together, and it would go something like this. We'd have our Palo Alto firewall right here, and for our lab environment, I'm going to use Palo Alto 15, because that's the IP address I'm going to put on all of its interfaces.

10:20So I'm going to go ahead and call up PA 15 here. So for its network interface cards on this VM, we're going to use 1/1 and 1/2, and I'll put 1/3 over here, and this is going to lead out to respective networks here and here. Let me also make a note of what those are. So this is going to be VLAN 10, and this is going to be VLAN 20, and the address space here is 10.10.0.0, and on the VLAN 20, the IP address space is 10.20.0.0. Everything is going to be a /24, and then over here, we're going to have, for example, a Linux client, and over here, a Windows client.

10:56So I'll put L there for Linux and W for Windows. And over here, this can represent our DMZ network. And for our DMZ network, let's go ahead and use the address space of 10.30.0.0, again, with everything using a /24-bit mask. So that's going to be VLAN 30. Put that in parentheses. And then through the interface 1/6, that will be our connectivity out to the public internet or what the Palo Alto believes is the public internet. So the address space is 23.1.2.0, and the service providers IP address, which is R1 right here, would be at .1.

11:29And again, on the PA 15, all the interfaces are going to end with a .15. So in this video, we've taken a look at a few of our options regarding deploying a lab environment with physical or virtualized gear, and in this video, we did a behind-the-scenes look from a physical topology and also, from a logical view of what it would look like as a VM inside of an ESXi environment. So in the next video, what I'd like to do is start the process step by step of deploying each of these components and walking through that in case you want to do it as well. So see you in the next video for exactly that. Until then, I hope this has been informative, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] Now that we've taken a look at some of the options regarding deploying the Palo Alto firewall as a VM in an ESXi environment, what I'd like to do is walk you through each of those components. You need a first hand view of what they look like. So our goal is to deploy the firewall as a VM and the ESXi environment. And in order to deploy that VM, we have to have the file. So the best place to go for those files is to your Palo Alto account.

0:30Go to Support and download the OVA file that's appropriate for the ESXi environment. So let me walk you through that right now. So I've logged in to the Palo Alto networks customer service portal. And on the left hand side here, I'm going to go down to Updates and expand that. And under Updates, we have a section for Software Updates. So I'll click here on Software Updates. And then we're getting software updates. I'm going to go ahead and do the PAN-OS for VM series based images. That's the one that's appropriate for an ESXi environment. There's also options there for KVM, and hyper-v, and others.

1:04And here is version 11. So we'll go ahead and click on the download link right here, and I'll simply download that to my downloads folder. And through the magic of editing, that download is already done. So our next step would be to log in to the ESXi host here, and this is the server that's behind me in the rack. And we'll simply deploy the OVA that we just downloaded from Palo Alto. So this is a power edge R630. It's got a whole bunch of RAM. And currently, it's not working very hard, so I think we're good to go. So I'm going to right click here on Host.

1:34And from the dropdown menu, I'm going to click here on Create/Register VM. And because we have an OVA file that we're going to use to deploy the VM, we'll go ahead and select that option here, and then click on Next. And I'm going to call this Demo PA Firewall, and then click here to go ahead and select the OVA file that I just downloaded. So I'll do that now. So I selected that file, PA VM ESX-11.0.0.OVA, and click on Next. And it's asking me which data store effectively-- what storage device do I use to support this VM? I'm going to go ahead and choose the local SSD, it's got some room there.

2:07We'll click on Next. It's going to power on automatically as it deploys. It's also going to use thin disk provisioning to not waste any space on the storage that doesn't really need. And for network mappings, it's going to place it in a port group that's on my management network. Now, this could be a problem and it happens to be a problem in my topology and I'll tell you why. I already have a device on my management network at 192.168.1.1. That's the default gateway for this main network right here. And by default, it's going to try to use the IP address of 192.168.1.1.

2:38So what I'm going to do is I'm going to go ahead and specify a different port group to connect this VM to because I don't want to have a conflict with the same IP address trying to be used twice on two different machines. So I'm going to go ahead and use a port group that I have that's called Parking Lot. Effectively, it's a port group on the virtual switches that goes nowhere. And that way, I can go in at the CLI, we can modify the IP address as needed , and then move forward. So they'll just be a temporary placement, and this is for the management interface on the VM. So we'll go ahead and click on Next, and then we'll click on Finish.

3:09All right, so if we go here to Recent Tasks. That is on its way. So that should take-- I don't know, four or five minutes to deploy, and it may take another four or five minutes to fully initialize. So here's what I thought we would do. While that's cooking, in the next video, let me walk you through the details regarding the networking here on the ESXi host that's making this all possible. So I'll see you, my friend, in the next video as we take a closer look at that networking here inside of ESXi. Until then, I hope this has been informative, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] In the previous video, we deployed the firewall, the OVA file inside of our ESXi environment. And that will take just a few minutes. So while that's cooking, let me also, in this video, show you the networking inside of ESXi that's making all the connectivity possible. So let me share with you inside of ESXi the details regarding this switch that we're using for trunking and also this switch that we're using to connect out to the management network. So here at the ESXi host, I'm using ESXi-3 for this.

0:32On the left-hand side, we can click on Networking. And let's start off with our switches. So I've got virtual switch zero, which I'm currently using for my management traffic. And then I've got a switch called trunk_switch that's supporting all the separate VLANs. So let's take a look at the trunk_switch first by clicking on it. And over here, on the right, we have the vSwitch topology. And I want to point out the VLANs that we had in our diagram. So here is a port group called VLAN 30 10:30.0.0. And effectively, what it is it's a port group that's associated with VLAN 30.

1:02So any devices that we connect to this port group are going to be connected to VLAN 30. So right now, it looks like I've got a couple of Linux computers. I've got a couple of PA firewalls I was playing with that are currently connected but not powered on. And if we scroll down to VLAN 10, here's yet another port group called VLAN 10, which is associated to VLAN 10. And once again, any devices that we connect to this port group will have connectivity into that VLAN. And so, if we use the IP address space of 10.10.0 all the devices in this port group, that's what effectively makes this VLAN 10 associated with the 10.10.0 network.

1:38So as we scroll down, here is VLAN 23. This is for the service provider network. And so any devices that we connect here, including this little device here, is going to be connected to VLAN 23. And then our last network was VLAN 20, that we had in our topology. So here's VLAN 20, which is a port group here on this virtual switch. And then virtual machines where we connect their little VM network adapter logically to this VLAN 20 port group. That's what makes them part or connected to VLAN 20. Let me also show you vSwitch0, which I'm currently using for management.

2:10So here is a port group. It's called A 192 management PG for Port Group. And effectively, any device that we connect here have physical connectivity to my external switch. So this vmnic0, vmnic, is the name of the physical interface on ESXi host that's used for connectivity between the ESXi host and the outside ethernet physical environment. And currently, I have a few different devices that are currently connected there as well. So if we look back at our topology to kind of put this all together, this is a representation of four of the port groups that we just looked at, VLAN 10, VLAN 20, VLAN 30, and also VLAN 23.

2:43And then over here, we have our vSwitch0, which I've labeled here as management switch. And then this virtual switch has connectivity out to the physical world out to the vmni interface on the ESXi host. And that's how this device, R1, and this topology is getting access to the outside world is because this interface right here is connected to this virtual switch and this virtual switch has connectivity to the physical switch on the outside. So that's the networking component inside the ESXi host. And in the next video, let's take a closer look at this device right here, which is labeled in our topology as R1, which has one of its interfaces here in the port group called 23 and another interface connected to my management switch, which leads off to the other router in my environment, which then leads out to the public internet because I want to show you the details of what I'm doing here as well, in the event that you want to replicate this and do it too.

3:29So I'll see you in the next video as we take a closer look at this router right here. Until then, I hope this has been informative, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] A key component to helping our lab feel alive and real is making sure we have internet connectivity. So in my lab environment, I've got a little virtual machine running on the ESXi host, which is playing the role of an internet service provider, and it's in this video that you and I get to take a closer look at the configuration of that device. So this router right here is performing NAT services. So from the firewalls perspective, as it forwards traffic to its default gateway at 23.1.2.1, this device is doing port address translation, forwarding it over my home office network 192.168.1 down to the next router in the path who's also doing PAT to forward that traffic out to the internet.

0:44And this way, in my lab environment, I could avoid using RFC 1918 addresses on the outside interface of the firewall. So, in this case, the firewall thinks, oh, I'm connected to the 23.1.2.1 network with our service provider, who this device is pretending to be, being the default next hop address for access out to the internet. So let me show you a closer look at the details regarding this router inside of our virtualized environment. So if we go back to Networking and we look at vSwitch0 here, one of the devices that's connected to this management port group here on vSwitch0 is this bad boy right here.

1:18It's called vyos-23 SP-A, and that's that little router. So we click on that device that's going to show us the details for that specific VM. So this is a vyos router. They're very small images. And I'll walk through the configuration here in just a moment. But as far as its network connectivity, look down here at the rightful. For this little VM, it's got adapter 1 that's connected to the port group VLAN 23.1.2, which is the port group supporting VLAN 23. And it's got a second network adapter connected to my port group that's over on vSwitch0, which leads off to the next hop address for the other routers in my topology that lead off towards the internet.

1:54So when we look at the VM, adapter number 1 is going to show up as ethernet 0, and adapter 2 is going to show up as ethernet 1. So let me open up a console to this little VM, and let me show you the config. So it's opening up a VMware Remote Console. And let me make the screen just a little bit bigger. All right, that's a little bit better. So I'm going to log in as vyos with the default password of vyos. And let me go ahead and do a show config and press enter. So here's the configuration for ethernet 0, which is this adapter right here.

2:25I'll just make a note of that, ethernet 0. And it has the IP address of 23.1.2.1 with a 24-bit mask. And then adapter 2, which is called in the interface ethernet 1, I'm using DHCP. So whatever IP addresses are available on my management network, the 192.168.1 network, it'll go ahead and simply grab an IP address. And then, as we scroll down just a little bit, I'll press enter a few times here. So next, let's take a look at the network address translation I've got set up. So I set up a rule for source NAT. It's rule 100, which says if traffic is leaving or going out of ethernet 1, which is the 192 address space interface, and if the source is coming from 23.1.2.anything, then I want to go ahead and do masquerading.

3:07Effectively, that means they're doing port address translation. So any traffic that comes in on the firewall here if the source address 23.1.2.anything, it'll go ahead and do port address translation overloading on whatever the DHCP assigned address is here on ethernet 1. And by setting up those constraints, by making sure we're only going to accept source addresses in this range, it also is going to help us reinforce the idea that, hey, if we have clients going through our firewall, we need to make sure that the Palo Alto is doing address translation if we want that traffic to successfully make it out to the internet because this device right here, this little vyos device is not going to do address translation on anything sourced outside of the 23.1.2 address space.

3:47And as we scroll down a little bit further, let's see if there's anything else of note. I also have DHCP services on that network. So if we wanted to have our WAN interface or our WAN-facing interface on the Palo Alto, be it DHCP client, this little vyos router would hand out an IP address, and that is pretty much it regarding this little VM that's playing the role of our service provider in our lab network. So now that we've taken a look, first of all, at the networking inside of ESXi and now we've taken a look at the little router providing the ISP services from our virtualized environment out to the physical world, in the next video, let's continue our configuration of the OVA, the firewall OVA that we deployed a few videos ago.

4:25So I'll see you in the next video for exactly that. Until then, I hope this has been informative, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] A few videos ago, we deploy the OVA from Palo Alto inside of our ESXi environment, and did it in about 15 or 20 minutes to go ahead and initialize. In this video, I'd like to continue our bootstrap configuration of that OVA, of that virtual machine. And on this virtual machine, this Palo Alto OVA that we just deployed, we're going to use .15 for all of its interfaces. So I'd like to start off with the management interface through its configuration first, and then we'll proceed to look at the details for the other network interface cards to make sure they're placed in the appropriate VLANs by associating those interfaces with the appropriate port groups inside the ESXi environment.

0:43So here in the ESXi environment, let me go ahead and find that VM. So here's our demo PA firewall right there, and it's going to open up a console to it. So that way, we can begin our initial configuration. So we'll go ahead and click here on Launch Remote Console. So here is our console. And let me make that a little bit bigger. Here we go, that's better. Also just as a note, when you first deploy the OVA, it might take up to 15 minutes before it's fully ready for you to log in. So I've noticed that even though it gives me a login prompt, the logins are not going to function until it's had enough time to settle and get fully initialized.

1:16So the default login here on this VM that we just deployed from the OVA file we got from Palo Alto, the default username is admin, and the default password is admin. So once we supplied that, it wants us to go ahead and change the password. So I'm going to put in the old password of admin, and then put in the new password of something different than admin. So I supplied that password, and I'll now confirm it and press Enter, and now we go ahead and begin our configuration. So we'll type in configure, press Enter, and we want to do a few things, including setting up the management IP address on this device to 192.168.1.15.

1:51So if we issue the command show and press Enter, it'll show us the full configuration. So we want to specify the type as set to static as opposed to being a DHCP client. And let's go ahead and set the type to static. And then furthermore, I'll hit the up arrow key, and let's go ahead and set the IP address itself with the command set device config system IP dash address. And then we'll go and put the IP address in of 192.168.1.15. And we can also follow that up right here with the net mask, which is three octets on, 255.255.255.0.

2:23And we can also further put the DNS information there as well. But I'm going to press Enter, and I'll do that on a separate line. So we'll begin with set device config system, and we'll go ahead and do DNS dash setting. And we'll say the primary DNS server, and we'll do a question mark for context sensitive help. We'll type in servers, and context sensitive help, and primary, and we use Google at 8888, that'll work. And then type in commit to go ahead and commit that. And once it's done, we should be able to ping 192.168.1.15, which is on the management interface, from my management computer, which is on that same network.

2:57So while that's doing its commit, let me go ahead and bring up a command prompt and we'll test some basic connectivity. So here is a command prompt on my local management computer, and let's do a ping out to 192.168.1.15. and services, and the ping is not working. So let's think about why that is. Let me go ahead and do an ARP dash A, and I don't even have the layer 2 address for .15, why is that? Oh, I know why that is. [LAUGHS] Let's take a look at this Palo Alto firewall we just deployed, I put all of its adapters in the parking lot.

3:30So let me go ahead and let me add some additional adapters here. And also while we're here, let's go ahead and place those adapters in the appropriate VLANs. So we're going to want a total of seven interfaces because the first interface here is going to be our management interface, and then the second interface is going to be 1/1 and so forth. So I'm going to click here on Edit to edit the details for this VM. And let me add some network adapters 1, 2, 3, 4. And there they are. I'll click on Save. So there's our seven adapters, and let's go back to editing and let me put them in the right VLANs.

4:03So interface number 1 is the management interface. And so I want that on my management network. And interface number 2 is 1/1. So let me document those real quick. So this is the management interface. This is 1/1, 1/2, 1/3 1/4, 1/5, and 1/6. Also before I make these changes here at the VM network interface level, let me also just take a look at our topology and make sure I'm going to put the right interface in the right VLAN. So if we go back to our drawings here, we want 1/1, that's going to be in VLAN 10, 1/2 in VLAN 20, 1/3 in VLAN 30, and 1/6 in VLAN 23.

4:43And we won't be, for the moment, using interfaces 1/4 or 1/5. All right. So with that in mind, let's go make sure those interfaces are appropriately assigned. So the management interface will be in the 192 management port group, and then 1/1 is going to be assigned to VLAN 10. So we'll apply that there. And 1/2 is going to be assigned to VLAN 20. So let me go ahead and grab that port group right there. And one last is going to be in VLAN 30, which is right there. We're not using five or six at the moment, so we put them in the parking lot.

5:14It's basically a port group that goes nowhere. And also take network adapter seven which is on the appliance, that's going to be 1/6, and let's put that into VLAN 23 just like that. And then we'll click on Save. I also want to confirm that that took. So let's go ahead and check our work. So the first interface, which is the management interfaces, is on the network, that port group. And then 1/1 is in VLAN 10 1/2 is in VLAN 20, 1/3 is in VLAN 30, and then 1/6, which in the interface here on the ESXi host shows is adapter number seven is in VLAN 23.

5:47That's going to go over to our VyOS router, which is serving the role of our internet service provider in the lab topology. So now, we should be able to-- from my management computer, which is also on the network 192.168.1.15, we should be able to ping the .15 addresses associated with the management interface on the Palo Alto. So here's the command prompt on my local computer. And let me do an IP config real quick just to verify my IP address. So sure enough, I'm at 192.168.1, and my host address is 151. And let's do a quick ping over to 192.168.1.15.

6:20And service says-- yay, [LAUGHS] that's a good indication. So we're able to go ahead and connect to the management interface from my management computer. What that also means is that we should be able to open up a browser and connect via HTTPS, once again, from this management computer over to the management interface on the Palo Alto. So let's try that as well. All right. So I've opened up a browser with HTTPS to that IP address and it says, we don't trust the certificate. So we'll go ahead and click on Advanced. That's expected on a brand new device. And we'll click on Proceed, and then we'll go ahead and log in.

6:52So I'll log in as admin with the password that I changed earlier at the command line. And says welcome to Pan OS 11. And I say, great, thank you very much. Click on Close. And here, we have the graphical user interface for this Palo Alto firewall. So currently, it is not licensed. So we look here at the VM license, that says none. And if we were to go over to the device tab up here, and on the left hand side, go down to licensing by clicking here on licenses, currently, it is not licensed. But once again, even if you have a VM or even an appliance that's not licensed, you can still do a lot of the basic functionality, including network address translation, and many different security policies, and practice with the stateful filtering nature of the firewall even though it doesn't have the full capabilities that you would in the event that you had a license.

7:37So we go back to the dashboard, and let me also confirm a couple of pieces as well. Since we're right here in the interface, let's go to-- under Device, we'll go to Setup. So here under Interfaces-- so Device, Set Up and Interfaces, if you click on the Management Interface, here it has the IP address that we signed. Oh, and it doesn't have a default gateway. So let's go ahead and do that now. I forgot to do that at the CLI. So we'll do a 192.168.1.1. And from the management network, that is the default gateway that this Palo Alto can use as it does things like connect up to the Palo Alto cloud, and gets updates, and so forth.

8:09So I need that to be in place. So I'm glad we checked that. We're allowing ping on this management interface. That's why we could ping it earlier. We'll click on OK. And also while we're here, let's click on Services and click on the gear icon, and just verify that our DNS is currently set up. It is. And if we want to set up NTP, we can do that right here as well. So that all looks good. So I'm going to go ahead and click up here on Commit in the upper right just to make sure that changes about the default gateway are now in play and they're running configuration. And we'll click on Commit. So while that finishes the commit, let's take a look, once again, at our topology.

8:42So up to this point, here's what we've got. We've got these interfaces-- 1/1, 1/2, 1/3, all associated with the correct port groups. The management interface is also associated with the correct port group. We were able to-- from my management computer, which is sitting here in my home office network. So here's our management PC right here. I was able to go ahead and connect to that firewall with HTTPS. And we preceded that with a quick connectivity test with a ping. And so now we've got this basic firewall sitting there ready to go. So in the next video, what I'd like to do is let's start off by doing some basic configuration regarding the IP addresses associated with these interfaces.

9:16So we'll assign this interface 1/1 with the IP address of 10.10.0.15. And then for 1/2, it'll be 10.20.0.15 based on these IP address spaces that we're using for those respective VLANs. And by setting up the interfaces with their appropriate IP addresses, we're further building this basic foundation in our lab environment which we can then build on. So join me in the next video as we continue our journey in the configuration of this firewall by applying basic IPv4 addresses to its interfaces.

9:46So I'll see you there in just a moment. Until then, I hope this has been informative, and I'd like to thank you for viewing.

0:06In the previous video, we both configured and verified basic management access over to the firewall that's running inside the ESXi environment. In this video, we're going to continue our configuration by applying IP addresses to the interfaces on the firewall. Also, for this firewall that we just deployed, which is this one right here, the demo PA firewall, I'm going to go ahead and shut it down. In fact, I'm going to go ahead and rudely powered off, because I'm going to switch over to a firewall, same exact version, version 11, of the firmware running on the Palo Alto, but I'm going to go ahead and start off with a Palo Alto firewall that I've already taken the steps of licensing.

0:41And that way later, when we get to the advanced features of threat prevention and so forth, the licenses will already be in place. So I'm going to take this existing firewall that we just deployed a few moments ago, and I'm going to remove it from my ESXi environment, just like that. All right, so it is gone, and the firewall that I want to go ahead and bring up, where it'll pick up right where the other one left off, is this one right here, which is PA-15. So let's go ahead and take a look at the details before we power it on. So it's got seven network adapters, a management interface, plus one for VLAN 10, VLAN 20, VLAN 30, and also one on interface 1/6, which is connected to VLAN 23.

1:18So we'll go ahead and we'll launch this by clicking Power On, and through the magic of editing, that power on is going to take just a few seconds. In a production environment or in a lab environment, it may take 4 to 6 minutes for the firewall to fully initialize and get going. So while that's coming up, I'm going to bring up a Command prompt here from my management computer and just do a real quick ping over to 192.168.1.15. I use the same exact IP addresses that we did in the demo a moment ago. Press Enter. So we have basic IP connectivity, so the next step would be to go ahead and bring up a browser and see if we can connect via HTTPS.

1:55So it's been about a minute or two. Let's go ahead and try logging in again to the Palo Alto firewall. All right, so I am logged in. So again, just to verify a few components. If we click here on Device and on the left, we select Setup and we go to Interfaces, here, I've got the management IP address that's currently set. I've got the default gateway set. Fantastic. We're allowing ping on the interface as well as HTTPS and SSH. Great. Great. Great. And then if we click here on Services and we click on the gear here, I just want to verify that I have my DNS information set up, and I think I also set up NTP, which I did.

2:28So we're able to synchronize with an NTP server on the internet. So no changes there. So that looks good. So having verified that, we can continue our configuration of the actual interfaces here. So let's take a moment, look at our topology, have a good plan in place, and then we'll go ahead and implement it. Also, now that we've taken a look at the details around the connectivity with the firewall and the virtual switches in the outside world, let's go ahead and clean this up a little bit for a standard topology that we can use going forward. And I'm going to name this one PA-15. And that's because on this firewall, every single interface it has, it's going to have the last number of its IPv4 address as 15.

3:04And then for the interfaces, we have interface 1/1 and 1/2 and interface 1/3 that we're going to be using. And as we verified, each of those interfaces is now connected to a respective VLAN. So interface 1/1 goes to VLAN 10, and interface 1/2 goes to VLAN 20, and interface 1/3 is connected to VLAN 30. I'll label those as well. So that's VLAN 30 there, and its IP dressing space is 10.30.0.0. And for VLAN 20, I'm going to label that, V20, and its IP address space for using there is 10.20.0.0, and for VLAN 10, the IP dressing space we're using there is 10.10.0.0, and we draw some connectivity there.

3:47So we are connected to that VLAN there through 1/1, and this VLAN here through 1/2 and to this VLAN 30 network, through 1/3. And then to the outside world, we're using the interface of 1/6, which from the Palo Alto's perspective is connected out to the internet. So I'll go ahead and draw a cloud representing the internet, and behind the scenes, this connectivity out to the internet is really in my lab environment using VLAN 23. And the service provider's IP address here, at the edge, in my little lab environment is that little wireless router, and it's at .1, and this network address space is 23.1.2.0 with a 24-bit mask.

4:24And also, just for reference, I've also got the management interface right here, which in the VMware environment is the first adapter, the network adapter, and that is the 192.168.1 address space. And again the PA-15 is going to be using .15 on all of its respective interfaces. Now, a big part of most vendors' firewalls, including the Palo Alto firewall, is to leverage the concept of zones. So in our case, we could say that these two internal networks, these VLANs 10 and 20, perhaps, they are part of a zone called Inside, so I'll label that as the Inside zone.

4:58And everything that's hanging off of interface 1/6, going out towards the internet, which is a less trusted network address space, to be sure, we can put that interface in a zone called the Outside zone. And then for VLAN 30, perhaps we wanted to use it as a demilitarized zone, and so what we could do is we could put interface 1/3 in its own zone, and perhaps, we call it DMZ. So that's the DMZ zone. And one of the benefits of setting up zones is that we can use zones as part of our security policies to specify what is allowed. For example, we may want to use our-- in fact, let's draw a couple of computers here.

5:31So let's imagine we have a Linux computer right here that's connected to this network, and let's imagine a Windows client here that's connected to this VLAN, and let's also imagine a server that we could place on our DMZ, which is connected there. I'll put S for server. And while we're at it, I'm going to document what that IP address is, it's .100 on that 10.30.0 subnet. While the Linux client and the Windows client can both be DHCP clients getting an IP address assigned from a DHCP server, which could be a server running in this environment, or we could have the Palo Alto itself act as a DHCP server.

6:07And back to our discussion regarding zones, we can set up policies that specify that traffic that is sourced from devices that are coming into the firewall on the interfaces that are part of the inside zone, if that traffic is destined to IP addresses that are routed out through this outside zone through 1/6, we can specify that traffic is allowed. Or if we had people on the internet that we wanted to be able to access a public-facing server, for example, we could go ahead and do destination NAT, so this server appears as a globally routable address here on the internet. And from a permissions perspective we could specify the permissions to allow traffic from people on the outside zone, as they're trying to access the server, which is on the DMZ zone.

6:46And so the reason I also bring up the concept of zones right here is because, if we're about to configure IP addresses on these interfaces, on interface 1/1, giving it the IP address of 10.10.0.15 and on 1/2, the IP address of 10.20.0.15, and so forth, part of that configuration is going to be asking us, not only what is the IP address, but also, what zone do you want to put that interface in. So as far as our game plan, I would like to have three zones to begin with, the outside zone, the DMZ zone, and the inside zone, and then when we put the IP addresses on those interfaces, we'll make sure we also include these zones that those interfaces belong to.

7:21So having said that, let's go back to our firewall, and let's configure the IP address and zone membership for interfaces 1/1, 1/2, 1/3, and 1/6. So to configure those interfaces, we're currently at the Dashboard tab. We want to go over to the Network tab here on the Palo Alto. And at the very top on the left, it's showing us the option to configure the interfaces. Right below that, we have the option here for creating zones. Now, one of the benefits is, if you don't have zones already created, while you're configuring the interfaces gives us the opportunity to step out for just a moment, create the zone, and then make sure that interface belongs to the zone.

7:56So even though we want the three zones, we don't have to go here first to create them. We can just do it right here from interfaces. So let's start off with interface 1/1, which is connected to VLAN 10. So to configure interface 1/1, we'll click on it. We're going to specify the interface type. So we're going to go ahead and have separate videos and discussions. We're getting interface types and how they work and why they're important. For now, we're going to do traditional Layer 3 interfaces. Think of a Layer 3 interface as an interface that's going to have an IP address associated with it. And here, on the subtab called config, it's asking us, regarding this interface, who do you want to assign it to?

8:30For example, which security zone do you want it to be a member of. So we use the dropdown, and we don't have any, so this is the moment where we can go ahead and create one. So we want ethernet 1 to be in a zone called Inside. So we'll click here on New Zone. For the name, we'll call it Inside. I'll leave everything else to the defaults, click on OK. And now, this interface, once we commit the whole process, will be a member of the Inside security zone. I also want to go ahead, for routing purposes, and I want to create a special logical router that each of these interfaces is going to be associated with as well.

9:00So here next a virtual router, it currently says None. We'll use the dropdown, and let's go ahead and create a brand new virtual router. So over here on the left, there's also the option to create a new virtual router, but we can do it right here as well, and let's call this Our Router, just like that, and we'll take all the other defaults and click on OK. So now, this interface, once we commit the process, is going to be associated with the zone called Inside, and also, any network it's directly connected is going to become part of this logical router called Our Router. And then, of course, we want to assign an IP address, so we'll click here on the IPv4 subtab, and we'll click here on Add to add an IP address.

9:36And the IP address we're going to add is 10.10.0.15, based on our plan, with a 24-bit mask, and then we'll click on OK. So there we go, interface 1/1 done, and we'll repeat that process for 1/2. So we'll click on 1/2, we'll specify that it's a layer interface, meaning an interface that's going to have an IP address. We'll associate it with the virtual router called Our Router and the security zone called Inside. And then we'll click on the IPv4 subtab, and we'll assign the IP address there as 10.20.0.15 with a 24-bit mask, just like that, and click on OK.

10:12And then we'll go to 1/3, which is associated with VLAN 30, which is using the 10.30 address space. So we'll click on ethernet 1/3, we'll specify that it's Layer 3 interface as well. And then for the security zone, we want it to be in a security zone called DMZ, which doesn't exist yet, so we'll go ahead and click right here on New Zone to create it. So we'll call it DMZ and click on OK, and we'll send this interface also to the new virtual router we just created and then click on the subtab for IPv4 and specify its IP address based on our plan, which is 10.30.0.15 with a 24-bit mask, just like that, and we'll click on OK.

10:48And then we want to go down to interface 1/6, in fact, let's take a look at our notes real quick. So interface 1/6 is in VLAN 23, and we're going to want to assign the address of 23.1.2.15 to that interface, and we're also going to want to make sure we assign it to a zone called Outside, which will also create. So we'll go down to interface 1/6, we'll specify the interface type of Layer 3, and we'll assign this to the virtual router called Our Router, and the security zone we want it in is Outside. So it doesn't exist yet, so we'll click here on New Zone to create it.

11:19We'll call it Outside, click on OK, and then click on the subtab for IPv4, click on Add, and we'll add the address of 23.1.2.15 with a 24-bit mask, just like that, and click on OK. So now, we've configured four Layer 3 interfaces with IP addresses. We assigned them all to the same virtual router, and we assigned them all to the respective security zones-- Inside, Inside, DMZ, and Outside. Now, you'll notice that none of these link states show as active, and also, all these configuration changes, they are not running yet on the actual firewall.

11:52And that's because to apply these changes, we need to click here on Commit. So in the upper, right-hand corner, we'll click on Commit. It's giving us a scope regarding what it's doing, so it's creating some new zone objects, and it's also creating a new virtual router and also, assigning some interfaces to that virtual router and to those zones and also, applying IP addresses. We can expand that to take a look at the details there. We also have an option of previewing the changes. So if we click here on Preview Changes and then click on OK, it's now showing us the changes that are about to be made.

12:22So we're adding some details to each of the interfaces, we are creating a new virtual router, and we're creating some new zones, so all that looks good, and we'll click on Commit. So depending on the platform and how many changes there are, the commit may take anywhere between 15 seconds and several minutes. So if we click on Close right here, it doesn't mean we're canceling the commit, it's still in the background working on that commit to the running configuration. And if we want to see our current status, down here on the bottom right, if we click on Tasks, that will bring up our listing of all tasks, including the commit that is currently in place.

12:54All right, so that's almost done. So while that completes, in the next video, let me also walk through some of the virtual machines that we'll be using inside of ESXi, as part of our lab environment. So I'll see you there in just a moment for exactly that. Until then, I hope this has been informative, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] In the previous video, we configured some zones, a new virtual router. We had configured IP addresses on four of the interfaces and assigned them to the appropriate zones on the virtual router. In this video, I'd like to walk you through some of the VMs that we're going to be using as part of our lab topology. So here in our topology, I would like to have a little Linux machine sitting right here on VLAN 10, a little Windows computer sitting here on VLAN 20, and our server over here on VLAN 30.

0:32So to make that happen inside of ESXi we take those VMs and make sure their network interface card is associated with the appropriate port group on the virtual switch. So the Linux machine should be connected to the little port group for VLAN 10 on the trunk virtual switch. And the Windows computer should be connected to the VLAN 20 port group. And the server, on one of its interfaces, should be connected to the VLAN 30 port group. So let's go into the ESXi environment and verify those three. So here inside of ESXi-- let me go to Virtual Machines, and let me sort by which ones are currently running.

1:04So there's our lab firewall right there that we're using. And let me scroll down. And let's use this Windows 11 computer right here. In fact, I'm going to rename that. I'll right click and rename the entry just here in VMware. I'm going to call it Win 11 for Palo Alto. Press Enter and then click on Rename. And that way I'll make sure I get the right one every time. And while we're here, let's click on it, and let's verify where it's currently connected. So it shows as being associated with the VLAN 20 port group, so that should be in the VLAN 20 network, just like that.

1:35So let me go ahead and power it on. And while that's powering it on, let me go back and look at our other virtual machines. And let's find a Linux machine for VLAN 10. And here we go right there. In fact, let me rename this. So I'll rename that little VM here instead of the ESXi Hypervisor, let's call it Linux for Palo Alto and click on Rename. And then let's click on it, and take a look at the details. So currently this little VM is connected to a port group that's associated with VLAN 10, which is great. So let me ahead and power that one on as well.

2:05So let's open up consoles for each of these. So here on the Windows 11 machine, there's a few ways of doing it. We can right click here and go to the console and say Launch Remote console right here. Or we could do it from here Launch Remote console. Or depending on how the defaults are set up on your virtualized environment, you just click here and that will open up a console. So here is our Windows client right here. And let's bring up a command prompt. Let's just verify its IP address with an ipconfig. And it shows there's no default gateway, but it has an IP address of 10.10.0.150.

2:39And if we look at the details for how that's configured, that is configured as a static IP address. As we look at the properties of the interface, so if we want to get an IP address automatically via DHCP, we can go ahead and specify that we do. Want to be a DHCP client click on OK. Click on OK again, and then go back to the CLI. Hit the up arrow key for ipconfig. And currently, no IP address yet. And one of the problems is that we don't have a DHCP server present. And that's why we're getting an automatic private IP address assignment space here on this interface is because there's no DHCP server available.

3:11And you know what because we're going to want some DHCP services, let's also take a moment right now as part of our bootstrapping of this firewall, to enable DHCP services on interface 1/1 and 1/2. So in our topology, we want to enable DHCP services here to support the 10.10 network. And here on the 1/2 interface to support the 10.20 network. And that way when we bring up our clients, that'll confirm also that this client and the interface on the FortiGate are in their respective same VLAN and also the same thing for the Linux machine and interface 1/1.

3:45If we can set up DHCP services and these clients can get the appropriate IP address from those DHCP servers running on the Palo Alto interfaces, then we have confirmation that we are on the same VLAN. So let's take a moment and also set up DHCP services on interface 1/1 and 1/2 here on the Palo Alto. And the way to do that is pretty easy here on the Palo Alto. We simply go to the Network tab up here. And with the Network tab selected, over on the left-hand side, we're going to click on DHCP, the Dynamic Host Configuration Protocol. And we're simply going to add DHCP servers, one for each of the interfaces.

4:17So to do that, here's a list of current interfaces supporting DHCP. And there aren't any so we'll click right here on Add. So we'll click on Add. And then we'll specify we want interface 1/1 to act as a DHCP server. And then we'll go ahead and ping before allocating a new IP address to help verify whether or not that IP address is already in use, and we'll click on Add. And we'll specify this pool is going to be 10.10.0. and we'll go 51 all the way through 10.10.0.99. And then for the options, let's also specify a default gateway, which once configured will be the firewall at 10.10.0.15.

4:54And the mask is going to be a three octet mask. And the primary DNS, let's hand out a Google DNS server. And with those in place, we'll click on OK. And let's do a similar treatment over for interface 2. So we'll look here an Add and we'll specify interface 1/2. And we'll do the ping, and also, instead of auto, I'm going to go ahead and specify just enable it no matter what. And then for the pool, we'll click on Add, so the pool for VLAN 20, which is 10.20.0. And let's do 51 all the way through 10.20.0.99.

5:24And go to options. And the default gateway there would be the Palo Alto once it's all set up, which is 10.20.0.15. and the mask is a 24-bit mask, so we'll put that in. And the primary DNS server that we can hand out is 8.8.8.8. And for the lease, let me also go ahead and change the timeout. So instead of saying an unlimited timeout, let's go ahead and just have it timeout after one day. So a client, if their lease is about to expire, they'll renew their lease, or they'll attempt to renew their lease. All right, so go ahead and click OK there. And before we commit to put this all in play, let me also go ahead and modify ethernet 1/1 and specify the timeout there as well.

6:02I'll go ahead and use one day. And also set this one to enable as opposed to auto and click on OK. Oh, and I don't see the DNS here information. So let's go ahead and look at ethernet 1/2. Maybe I didn't save it. Under Options, DNS, yeah, I must not have saved it 8.8.8.8, and then we'll click on OK. And let's check our work. So the lease time is one day on each. Here's the subnet ranges from which they'll handle IP addresses. And they're both handing out a default gateway pointing to their own IP address. Once we get the firewall configured, it'll be able to support that.

6:33So to put this in play, we'll go ahead and click on Commit. We can preview the changes if we want to see them. Otherwise, just click on Commit one more time. And then in about a minute or two, that information that we just configured will be part of the actual running configuration on the actual firewall itself. So we'll click on Close there. We'll let that finish in the background. And let's go take a look at our VMs. So our other machine, besides the Windows machine and VLAN 20, we have our Linux machine. We've already powered it on. Let's go take a look at that one as well. So here is that Linux computer right here. And because we just configured the DHCP services here on 1/1, we just applied the commit, I'm going to go ahead and reboot this Linux computer.

7:09So go here and click on the power button and say please restart. And when it restarts, it should initiate the DHCP process as a client. And hopefully, we'll have an IP address in the 10.10 address space here on VLAN 10. So we'll give that a moment to initialize, and let's go to a command prompt. And let's verify whether or not it has an IP address. So on Linux, it's ifconfig, press Enter, and here in this first interface, is 10.10.0.51. That's fantastic. So we'll also verify at the Palo Alto that that is indeed the IP address that we've handed out from our DHCP services.

7:43Also, while we're at it, let's check on the Windows computer right here. So I'll move the Linux out of the way. And here's our Windows computer. So we already confirm that the interface is configured to act as a DHCP client. Let's just confirm that one more time. So if we look at the properties of IPv4 obtain an IP address automatically, fantastic. And so if I just disable this interface and give it a moment and then right click and enable it again, what that should cause in the background when it comes up, it should have cause the DHCP process to kick in. And this computer should get an IP address from the 10.20 address space handed out from the Palo Alto.

8:16So let's open up a command prompt and verify that. So here at the command prompt, we'll do an ipconfig on this Windows computer and sure enough 10.20.0.51. So let's just verify for a moment that this Palo Alto did indeed hand out both of those IP addresses. The 10.10.0.51 to the Linux client and the 10.20.0 address over here to the Windows computer. So back to the Palo Alto we go. So up at the top, we're still on the Networks tab. And over on the left, we've selected DHCP. And then if we want to look at the leases for interface 1/1, we click right here under IP Pools, the link that says View Allocation.

8:50So we'll click that link, and sure enough, it's handed out the 10.10.0.51 to the Linux computer. And we'll do the same for ethernet 2, and click here on the link for View Allocation. Here it has the IP address handed out to the Windows computer, which helps us to confirm that the interfaces that we configured on the VMs and also the VM acting as the Palo Alto firewall, are all in the correct VLANs. So let's summarize. We now have this Palo Alto firewall that's running in our ESXi environment along with a Linux VM a Windows VM. We also have the server.

9:20We don't need him quite yet. We'll come back, and we'll verify that connectivity once we start using it. And we also have the interface 1/6, which is connected out to our little pseudo internet service provider router, which is our VIOS device. So now that we have this infrastructure in place, it provides a fantastic foundation on which we can build as we start working with, configuring, and managing a Palo Alto firewall. So thanks for joining me in this set of videos. And I look forward to seeing you, my friend, in the very next set. Until then, I hope this has been informative, and I'd like to thank you for viewing.