Alto MS Series User Manual download pdf (Page 12)

8 Getting Started Guide

Set Up Management Access to the Firewall Integrate the Firewall into Your Management Network

Step 6 Configure an external-facing interface and an associated zone and then create security and NAT policy rules to

allow the firewall to send service requests from the internal zone to the external zone:

1. Select

Network > Interfaces and then select your external-facing interface. Select Layer3 as the Interface

Type

, Add the IP address (on the IPv4 or IPv6 tab), and create the associated Security Zone (on the Config

tab), such as l3-untrust. You do not need to set up management services on this interface.

2. To set up a security rule that allows traffic from your internal network to the Palo Alto Networks update server

and external DNS servers, select

Policies > Security and click Add. For the purposes of initial configuration,

you can create a simple rule that allows all traffic from l3-trust to l3-untrust as follows:

3. If you are using a private

IP address on the

internal-facing interface,

you will need to create a

source NAT rule to translate the address to a publicly routable address. Select

Policies > NAT and then click

Add. At a minimum you must define a name for the rule (General tab), specify a source and destination zone,

l3-trust to l3-untrust in this case (

Original Packet tab), and define the source address translation settings

(

Translated Packet tab) and then click OK. For more information on NAT, see Configure NAT Policies.

Commit your changes.

Step 7 Verify that you have connectivity from the

data port to the external services,

including the default gateway, DNS

server, and the Palo Alto Networks

Update Server.

After you verify you have the required

network connectivity, continue to

Activate Firewall Services.

Launch the CLI and use the ping utility to verify that you have

connectivity. Keep in mind that by default pings are sent from the

MGT interface, so in this case you must specify the source interface

for the ping requests as follows:

admin@PA-200> ping source 192.168.1.254 host

updates.paloaltonetworks.com

PING updates.paloaltonetworks.com (67.192.236.252) from

192.168.1.254 : 56(84) bytes of data.

64 bytes from 67.192.236.252: icmp_seq=1 ttl=242 time=56.7 ms

64 bytes from 67.192.236.252: icmp_seq=2 ttl=242 time=47.7 ms

64 bytes from 67.192.236.252: icmp_seq=3 ttl=242 time=47.6 ms

After you have verified connectivity, press Ctrl+C to stop the pings.

Set Up a Data Port for Access to External Services (Continued)

1 2 ... 7 8 9 10 11 12 13 14 15 16 17 ... 107 108

Comments to this Manuals

No comments

Alto MS Series User Manual Page 12

Comments to this Manuals