Palo Alto Firewall PAN OS V11 - Zero-To-Hero - Part-2

Learn how to manage configuration backups for running and candidate configurations, save backup versions, and restore or revert to previous configurations using export, import, and config audit snapshots.

Learn to manage locks on Palo Alto firewall to restrict config changes and commits, understand candidate and running configs, and coordinate multi-admin backups and restores.

Discover how Palo Alto firewall user ID and captive portal enforce security policies by user identity, integrate with Active Directory, LDAP, Radius, and Kerberos, and provide detailed user-based logs.

Learn to read PanOS version numbers, distinguish major, minor, maintenance, and hotfix releases, and plan safe upgrades with release notes, hardware compatibility, backups, lab testing, and upgrade paths.

Demonstrate upgrading panos from 11.00 to 11.1.10 using panorama in a lab demo, with download or upload methods, base image dependencies (11.1.0), and software manager prechecks, installs, and reboots.

Explore Palo Alto firewall interface modes—layer 3, layer 2, vWire, tab, and sub-interface—and learn when to deploy each, including real-world use cases and security policies.

Configure a Palo Alto interface types lab in EVE-NG by building the topology, enabling L2 deployment with span and vwire modes, and configuring management via static IP.

Configure a Palo Alto vwire with inside and outside zones, enable dhcp, apply an interzone policy, and review logs, noting the two-interface limit and lack of routing or nat.

Explore deploying a Palo Alto firewall in layer 2 mode to switch internal vlan traffic, enforce zone-based security without routing, and compare layer 2 with vwire.

Configure a tap interface and monitor session to mirror traffic to the Palo Alto firewall, enabling traffic analysis, application identification, and preparation of security rules before migration.

Explore Palo Alto sub-interface deployment theory and lab: configure trunked interfaces, VLAN tagging, SVIs, inter-zone policies, and NAT for multi-VLAN networks.

Explore cryptography basics and its role in securing vpn connections on networks. Understand encryption, authentication, integrity, and key exchange with algorithms like aes and ChaCha20, and ipsec or tls.

Explore virtual private networks, including site-to-site and remote access VPNs, their overlay tunnels, encryption with IPsec/ESP, and protocols like OpenVPN, IKEv2, WireGuard, and GRE/IPsec.

Explore how to implement a site-to-site IPsec VPN between Palo Alto firewalls, covering phase 1 and phase 2 negotiations, IKE, DH, PSK, ESP, AH, and tunnel mode.

Learn to configure a Palo Alto firewall IPsec site-to-site VPN between two sites, including tunnel interfaces, VPN zones, static routes, IKE/IPsec crypto profiles, tunnels, and security policies.

Explore remote access vpn using GlobalProtect with a Palo Alto firewall, detailing client setup, gateway authentication, ipsec/ssl encryption, policy enforcement, and access to corporate resources.

Configure Palo Alto Global Protect VPN with inside, outside, VPN zones, tunnel interfaces, SSL certificates, authentication profiles, and portal and gateway setup; verify via Windows client with split tunneling.

Explore how Palo Alto firewalls achieve fault tolerance with high availability, covering active-passive and active-active deployments, failover triggers, and synchronization of network, object, and policy configurations.

Explore Palo Alto HA link types, including HA1 control, HA2 data, HA3 packet forwarding, and HA4 session cache synchronization, with backup links, dedicated vs in-band ports, and preemption rules.

Design and implement Palo Alto firewall active-passive high availability, configure ha1/ha2 links, inside and outside zones and interfaces, enable session state synchronization, and apply routing, NAT, and security policies.

Deploy panorama VM on ESXi by importing the 11.1.0 OVA from Palo Alto support; requires 16 GB RAM and 4-8 vCPUs, then configure management IP, DNS, gateway, license, and login.

Deploy panorama on vmware workstation by importing the panorama ova, configuring bridged management, and setting a static ip; allocate 4 cores and 8–16 gb ram, and change default credentials.

Panorama serves as a centralized management server for multiple Palo Alto firewalls and wildfire appliances. It enables centralized configuration, deployment, and logging with device groups, templates, and role-based access control.

Explore panorama models and deployment modes in Palo Alto Panorama, including panorama mode, management only mode, logger mode, and legacy mode, with M-series appliances supporting log collection, reports, and updates.

Learn how the panorama appliance centrally manages data centers, connects to lock collectors and firewalls, and uses port 3978 for device management, updates, and encrypted communication.

Configure panorama general settings by setting the management IP to 192.168.1.222, default gateway, DNS, time zone, and NTP, then commit and verify with show commands.

Master Panorama device groups and templates to centrally manage firewall configurations, licenses, content updates, including application threats, wildfire, antivirus, while understanding naming and resource requirements for Panorama modes and transitions.

Learn to add Palo Alto firewalls as Panorama managed devices by collecting management IPs and serial numbers, generating an auth key, and committing changes to establish connectivity.

Deploy a Palo Alto firewall on AWS using a new VPC with four subnets: mgmt, dmz, inside, and untrust; choose pay-as-you-go or BYOL licensing on EC2 with NAT.

Deploy a Palo Alto Networks firewall on AWS by building a four-subnet VPC (inside, outside, DMZ, management), configuring routing and IGW, then launching from the AWS marketplace.

Set up a Palo Alto firewall on AWS by attaching inside, DMZ, and outside interfaces, configuring DHCP, security groups, and disable source-destination checks.

Learn to deploy Palo Alto on AWS Part-3, attach an elastic IP to the outside interface, configure destination and source NAT, and enable private subnet RDP access.

Terminate the EC2 lab instances, cancel the Palo Alto VM series AWS marketplace subscription, and release elastic IPs to prevent charges and keep AWS billing minimal.