La red de Angel

There are situations where Palo Alto device certificates used for the Web Interface or GlobalProtect and issued by 3rd party PKI servers such as ADCS will expire because their root CA or intermediate CA certificates are also expiring. In these cases, the certificates must be renewed. However, there is a minor bug in Palo Alto devices: if two intermediate certificates share the same issuer (the root CA) but have different expiration dates, all imported certificates from that issuer will incorrectly be associated with the older intermediate certificate. For example: A Palo Alto firewall is using a 3rd PKI (Microsoft ADCS) to issue private certificates for the Web Console and GlobalProtect portals/gateways. Palo Alto contains the following certificates installed under Device > Certificate Management > Certificates Root CA      Old Intermediate Cert      To be expired soon/already expired         Current Global Protect  cert...

Prerequisites 1. Have 1 or multiple Palo Alto Firewalls onboarded to Strata Cloud Manager or sending Palo Alto logs directly to Strata Logging Service. 2. Have access to Strata Logging Service / Strata Cloud Manager console. 3. Have access to an AWS Console How to send Palo Alto logs to an AWS S3 bucket @AWS 1. Create a new S3 bucket . We will call it palo-alto-logs.  Take note of the AWS region (us-central-1, eu-central-1, etc) this will be required on a later step. Also for security, kindly enable Block all public access  in the S3 Bucket. It is not required to create an ACL so you can disable  this setting. 2. Create a new IAM role.  We will call it SLS_to_S3_access_role. During the creation of the IAM role, you need to select AWS Account > Another AWS Account > Enter the Account ID of Strata Logging Service.  This can be obtained when creating a new S3 bucket profile in Strata Logging Service, specifically here: Once the AWS Account ID it is obtaine...

# GET HIT COUNTS FROM ALL SECURITY RULES # import requests params = { 'key': ' {INSERT XML API KEY HERE} ', 'type': 'op', } data = { 'cmd': "<show><rule-hit-count><vsys><vsys-name><entry name='vsys1'><rule-base><entry name='security'><rules><all></all></rules></entry></rule-base></entry></vsys-name></vsys></rule-hit-count></show>", } response = requests.post('https:// {FIREWALL MGMT IP} /api/', params=params, data=data, verify=False) print (response.text) # GET  HIT COUNT FROM SPECIFIC SECURITY RULE # import requests params = {     'key': ' {INSERT XML API KEY HERE} ',     'type': 'op', } data = {     'cmd': "<show><rule-hit-count><vsys><vsys-name><entry name='vsys1'><rule-base><entry name='security...

Cause -->   This issue is directly related to high-availability configuration in SDWAN device in local device. If you are adding an standalone firewall as SDWAN device in Panorama with locally enabled HA configuration it will cause this problem. Solution -> You can either remove local HA configuration in the firewall or tou can implement HA with 2 member and then you can setup SDWAN in both devices as an HA group in Panorama SDWAN settings.

 Requirements Palo Alto VM series firewall on KVM (in my case, hosted in EVE-NG) Terraform.exe file (Downloaded from Terraform official page) Visual Studio Code software Connectivity to Palo Alto machine from the host machine Step 0 - Create a folder to host all Terraform files C:\Users\angel\scripts\paloalto Step 1 - Download terraform.exe file from Official Terraform page  I am using Windows OS for this example but you can use Linux, MAC or other OS types as well Install | Terraform | HashiCorp Developer Extract terraform.exe in folder where all Terraform files are located --> C:\Users\angel\scripts\paloalto Step 2 - Open Visual Studio Code and download the following Terraform related extensions: Terraform Hashicorp Terraform Terraform advanced syntax higlighting Step 3 - Create main.tf on terraform files folder C:\Users\angel\scripts\paloalto\main.tf Step 4 - Edit main.tf with the following basic code. Make sure that indetation is well respected on file terraform { ...

## REST API POST call that creates a new Security Zone in an target Template in Panorama ## import requests import urllib3 import json urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) url = "https://{panoramaIP}/restapi/v10.2/Network/Zones?name={name_new_ZONE}&location=template&template={target_template}&vsys=vsys1" payload = json.dumps({ "entry": { "@name": "{name_new_ZONE}", "@location": "template", "@template": "{target_template}", "@vsys": "vsys1", "network": { "layer3": {}, "log-setting": "default" } } }) headers = { 'Content-Type': 'application/json', 'X-PAN-KEY': '{PANORAMA_API_KEY}' } response = requests.request("POST", url, headers=headers, data=payload, verify=False) print(response.text)

Diagrama de red Configuración   Interfaces de red Rutas estáticas Creación IPSEC VPN Tunnel Reglas de Firewall 1 – Interfaces de red @PaloAlto @Fortigate @Cisco Router 2 – Rutas Estáticas @PaloAlto @Fortigate 3 – Creación VPN IPSEC Tunnel @PaloAlto   @Fortigate 4 – Reglas de Firewall @PaloAlto @Fortigate Verificar que el Tunnel funciona (mediante ping) @PaloAlto – From PA-LAN to FG-LAN via VPN @Fortigate – From FG-LAN to PA-LAN via VPN