Palo Alto Networks Administrator's Guide. Release 3.1

Transcription

1 Palo Alto Networks Administrator's Guide Release 3.1

2

3 Palo Alto Networks Administrator s Guide Release 3.1 2/25/10 Third/Final Review Draft - Palo Alto Networks COMPANY CONFIDENTIAL

4 Palo Alto Networks, Inc Palo Alto Networks. All rights reserved. Palo Alto Networks, PAN-OS, and Panorama are trademarks of Palo Alto Networks, Inc. All other trademarks are the property of their respective owners. P/N A

5 February 25, /19/2006 Draft - Palo Alto Networks COMPANY CONFIDENTIAL Table of Contents Preface About This Guide Organization Typographical Conventions Notes and Cautions Related Documentation Obtaining More Information Technical Support Chapter 1 Introduction About the Firewall Features and Benefits About the Management Interfaces Chapter 2 Getting Started Preparing the Firewall Setting Up the Firewall Using the Firewall Interface Navigating to Configuration Pages Chapter 3 Device Management About Virtual Systems Communications Among Virtual Systems Shared Gateways Defining Virtual Systems Configuring Shared Gateways About High Availability Setting Up High Availability Enabling High Availability on the Firewall About User Identification Agents Palo Alto Networks 3

6 About Captive Portals Configuring the Firewall for User Identification About the User-ID Agent for Active Directory About the User-ID Agent for edirectory or API About the Terminal Services Agent About Administrator Roles, Profiles, and Accounts Defining Administrator Roles About Authentication Profiles Setting Up Authentication Profiles Configuring RADIUS Server Settings Configuring LDAP Server Settings Creating Administrative Accounts Specifying Access Domains for Administrators Defining Client Certificate Profiles About the Firewall Logs About Log Destinations Defining Configuration Log Settings Defining System Log Settings Defining SNMP Trap Destinations Defining Syslog Servers Defining Notification Settings Scheduling Log Exports About System Setup, Configuration, and License Management Defining the Host Name and Network Settings Comparing Configuration Files Managing Configurations Installing a License Defining Custom Response Pages Upgrading the PAN-OS Software Updating Threat and Application Definitions Importing, Exporting and Generating Security Certificates Support for Certificate Revocation List and Online Certificate Status Protocol.. 79 Viewing Support Information Chapter 4 Network Configuration About Firewall Deployment About Virtual Wire Deployments About Layer 2 Deployments About Layer 3 Deployments About Tap Mode Deployments About Point-to-Point Protocol over Ethernet Support Defining Virtual Wires About Firewall Interfaces About Aggregate Interface Groups Viewing the Current Interfaces Configuring Layer 2 Interfaces Configuring Layer 2 Subinterfaces Configuring Layer 3 Interfaces Configuring Layer 3 Subinterfaces Palo Alto Networks

7 Configuring Virtual Wire Interfaces Configuring Aggregate Interface Groups Configuring Aggregate Ethernet Interfaces Configuring VLAN Interfaces Configuring Loopback Interfaces Configuring Tap Interfaces Configuring High Availability Interfaces About Security Zones Defining Security Zones About Virtual Routers and Routing Protocols Routing Information Protocol Open Shortest Path First Border Gateway Protocol Redistribution Profiles Defining Virtual Routers About DHCP Options About VLAN Support About Network Profiles Defining Interface Management Profiles Defining Zone Protection Profiles Chapter 5 Policies and Security Profiles About Policies Guidelines on Defining Policies About Security Policies About NAT Policies About Policy-Based Forwarding Policies About SSL Decryption Policies Specifying Users and Applications for Policies About Application Override Policies About Captive Portal Policies About Security Profiles About Antivirus Profiles Defining Anti-Spyware Profiles About Vulnerability Protection Profiles About URL Filtering Profiles Defining File Blocking Profiles Defining Data Filtering Profiles About Other Policy Objects About Addresses and Address Groups About Applications and Application Groups About Application Filters About Services and Service Groups About Data Patterns About Custom URL Categories About Custom Threat Signatures About Security Profile Groups About Log Forwarding About Schedules Palo Alto Networks 5

8 Chapter 6 Reports and Logs Using the Dashboard Using the Application Command Center Viewing App-Scope Reports Summary Report Change Monitor Report Threat Monitor Report Threat Map Report Network Monitor Report Traffic Map Report Viewing the Logs Managing PDF Summary Reports Managing User Activity Reports Managing Report Groups Scheduling Reports for Delivery Viewing Reports Generating Custom Reports Identifying Unknown Applications and Taking Action Taking Action Chapter 7 Configuring IPSec Tunnels About Virtual Private Networks About IPSec VPNs and SSL VPNs About VPN Tunnels About IPSec and IKE About IPSec and IKE Crypto Profiles Setting Up IPSec VPNs Defining IKE Gateways Defining IKE Crypto Profiles Defining IPSec Crypto Profiles Setting Up IPSec Tunnels Defining Tunnel Monitor Profiles Viewing IPSec Tunnel Status on the Firewall Sample VPN Configuration Existing Topology New Topology Configure the VPN Connection VPN Connectivity Troubleshooting Chapter 8 Configuring SSL VPNs About SSL VPNs How the SSL VPN Works Palo Alto Networks

9 Setting Up SSL VPNs Adding a new SSL VPN Downloading and Activating the NetConnect SSL VPN Client Creating a Local User Database Adding Local Users Adding Local User Groups Chapter 9 Configuring Quality of Service About Firewall Support for QoS Configuring QoS for Firewall Interfaces Defining QoS Profiles Defining QoS Policies Displaying QoS Statistics Chapter 10 Panorama Installation Installing Panorama Setting Up a Custom Virtual Disk Performing the Final Setup Accessing Panorama for the First Time Creating an SSL Certificate Chapter 11 Central Management of Devices Accessing the Panorama Interface About the Panorama Interface Panorama Tab Viewing Information on Individual Devices Adding Devices Defining Device Groups Managing Administrator Roles Specifying Access Domains for Administrators Upgrading the Panorama Software Backing Up Firewall Configurations Appendix A Custom Pages Default Antivirus Response Page Default Application Block Page Default File Blocking Block Page Default URL Filtering Response Page Default Anti-Spyware Download Response Page Palo Alto Networks 7

10 Default SSL Decryption Opt-out Response Page Captive Portal Comfort Page URL Filtering Continue and Override Page SSL VPN Login Page SSL Certificate Revoked Notify Page Appendix B Application Categories, Subcategories, Technologies, and Characteristics 239 Application Categories and Subcategories Application Technologies Application Characteristics Appendix C Federal Information Processing Standards Support Appendix D Open Source Licenses Artistic License BSD GNU General Public License GNU Lesser General Public License MIT/X OpenSSH PSF PHP Zlib Index Palo Alto Networks

11 February 25, /19/2006 Draft - Palo Alto Networks COMPANY CONFIDENTIAL Preface This preface contains the following sections: About This Guide in the next section Organization on page 9 Typographical Conventions on page 11 Notes and Cautions on page 11 Related Documentation on page 11 Obtaining More Information on page 12 Technical Support on page 12 About This Guide This guide describes how to administer the Palo Alto Networks firewall using the device s web interface. This guide is intended for system administrators responsible for deploying, operating, and maintaining the firewall. Organization This guide is organized as follows: Chapter 1, Introduction Provides an overview of the firewall. Chapter 2, Getting Started Describes how to install the firewall. Chapter 3, Device Management Describes how to perform basic system configuration and maintenance for the firewall, including how to configure a pair of firewalls for high availability, define user accounts, update the software, and manage configurations. Chapter 4, Network Configuration Describes how to configure the firewall for your network, including routing configuration. Chapter 5, Policies and Security Profiles Describes how to configure security policies and profiles by zone, users, source/destination address, and application. Palo Alto Networks Preface 9

12 Organization Chapter 6, Reports and Logs Describes how to view the reports and logs provided with the firewall. Chapter 7, Configuring IPSec Tunnels Describes how to configure IP Security (IPSec) tunnels on the firewall. Chapter 8, Configuring SSL VPNs Describes how configure virtual private networks (VPNs) using Secure Socket Layer (SSL). Chapter 9, Configuring Quality of Service Describes how to configure quality of service (QoS) on the firewall. Chapter 10, Panorama Installation Describes how to install the centralized management system (CMS) for the High Definition Firewalls. Chapter 11, Central Management of Devices Describes how to use Panorama to manage multiple firewalls. Appendix A, Custom Pages Provides HTML code for custom response pages to notify end users of policy violations or special access conditions. Appendix B, Application Categories, Subcategories, Technologies, and Characteristics Contains a list of the application categories defined by Palo Alto Networks. Appendix C, Federal Information Processing Standards Support Describes firewall support for the Federal Information Processing Standards Appendix D, Open Source Licenses Includes information on applicable open source licenses. 10 Preface Palo Alto Networks

13 Typographical Conventions Typographical Conventions This guide uses the following typographical conventions for special terms and instructions. Convention Meaning Example boldface italics courier font Names of commands, keywords, and selectable items in the web interface Name of parameters, files, directories, or Uniform Resource Locators (URLs) Coding examples and text that you enter at the command prompt Click Security to open the Security Rules page. The address of the Palo Alto Networks home page is Enter the following command: a:\setup Click Click the left mouse button Click Administrators under the Devices tab. Right-click Click the right mouse button. Right-click on the number of a rule you want to copy, and select Clone Rule. Notes and Cautions This guide uses the following symbols for notes and cautions. Symbol NOTE Indicates helpful suggestions or supplementary information. CAUTION Indicates actions that could cause loss of data. Related Documentation The following additional documentation is provided with the firewall: Quick Start Hardware Reference Guide Command Line Interface Reference Guide Palo Alto Networks Preface 11

14 Obtaining More Information Obtaining More Information To obtain more information about the firewall, refer to: Palo Alto Networks web site Go to Online help Click Help in the upper-right corner of the web interface to access the online help system. Technical Support For technical support, use the following methods: Go to Call (U.S, Canada, and Mexico). us at: 12 Preface Palo Alto Networks

15 Chapter 1 Introduction This chapter provides an overview of the firewall: About the Firewall in the next section Features and Benefits on page 14 About the Management Interfaces on page 14 About the Firewall The Palo Alto Networks firewall allows you to specify security policies based on a more accurate identification of each application seeking access to your network. Unlike traditional firewalls that identify applications only by protocol and port number, the firewall uses packet inspection and a library of application signatures to distinguish between applications that have the same protocol and port, and to identify potentially malicious applications that use non-standard ports. For example, you can define security policies for specific applications, rather than rely on a single policy for all port 80 connections. For each identified application, you can specify a security policy to block or allow traffic based on the source and destination zones and addresses (IPv4 and IPv6). Each security policy can also specify security profiles to protect against viruses, spyware, and other threats. IPv4 and IPv6 addresses are supported. Palo Alto Networks Introduction 13

16 Features and Benefits Features and Benefits The firewall provides granular control over the traffic allowed to access your network. The primary features and benefits include: Application-based policy enforcement Access control by application is far more effective when application identification is based on more than just protocol and port number. High risk applications can be blocked, as well as high risk behavior, such as filesharing. Traffic encrypted with the Secure Socket Layer (SSL) can be decrypted and inspected. Threat prevention Threat prevention services that protect the network from viruses, worms, spyware, and other malicious traffic can be varied by application and traffic source (refer to About Security Profiles on page 132). URL filtering Outbound connections can be filtered to prevent access to inappropriate web sites (refer to About URL Filtering Profiles on page 137). Traffic visibility Extensive reports, logs, and notification mechanisms provide detailed visibility into network application traffic and security events. The Application Command Center in the web interface identifies the applications with the most traffic and the highest security risk (refer to Reports and Logs on page 161). Networking versatility and speed The firewall can augment or replace your existing firewall, and can be installed transparently in any network or configured to support a switched or routed environment. Multi-gigabit speeds and a single-pass architecture provide all services with little or no impact on network latency. Fail-safe operation High availability support provides automatic failover in the event of any hardware or software disruption (refer to Enabling High Availability on the Firewall on page 30). Easily managed Each firewall can be managed through an intuitive web interface or a command-line interface (CLI), or all devices can be centrally managed through the Panorama centralized management system, which has a web interface very similar to the device web interface. About the Management Interfaces The firewall supports the following management interfaces: Web interface Configuration and monitoring over HTTP or HTTPS from an Internet Explorer (IE) or Firefox browser. CLI Text-based configuration and monitoring over Telnet, Secure Shell (SSH), or the console port (refer to the PAN-OS Command Line Interface Reference Guide). Panorama Palo Alto Networks product that provides web-based management for multiple firewalls. The Panorama interface is similar to the device web interface, with additional management functions included. Refer to Panorama Installation on page 219 for instructions on installing Panorama and Central Management of Devices on page 223 for information on using Panorama. 14 Introduction Palo Alto Networks

17 About the Management Interfaces Simple Network Management Protocol (SNMP) Supports RFC 1213 (MIB-II) and RFC 2665 (Ethernet interfaces) for remote monitoring, and generates SNMP traps for one or more trap sinks (refer to Defining SNMP Trap Destinations on page 63 and SNMP MIBs on page 245 Syslog Provides message generation for one or more remote syslog servers (refer to Defining Syslog Servers on page 64). Palo Alto Networks Introduction 15

18 About the Management Interfaces 16 Introduction Palo Alto Networks

19 Chapter 2 Getting Started This chapter describes how to set up and start using the firewall: Preparing the Firewall in the next section Setting Up the Firewall on page 17 Using the Firewall Interface on page 19 Note: Refer to Panorama Installation on page 219 for instructions on installing the Panorama centralized management system. Preparing the Firewall Perform the following tasks to prepare the firewall for setup: 1. Mount the firewall in a rack and power it up as described in the Hardware Reference Guide. 2. Register your firewall at to obtain the latest software and App-ID updates, and to activate support or subscriptions. 3. Obtain an IP address from your system administrator for configuring the management port on the firewall. 4. Set the IP address on your computer to and the subnet mask to Setting Up the Firewall To perform the initial firewall setup: 1. Connect your computer to the management port (MGT) on the firewall using an RJ-45 Ethernet cable. 2. Start your computer. Assign a static IP address to your computer on the subnet (for example, ). Palo Alto Networks Getting Started 17

20 Setting Up the Firewall 3. Launch a supported web browser and enter The browser automatically opens the Palo Alto Networks login page. 4. Enter admin in both the Name and Password fields, and click Login. The system presents a warning that the default password should be changed. Click OK to continue. 5. On the Device tab, click the Quick Start Setup link to open the Quick Start page. Figure 1. Quick Start Setup Page 6. Perform these tasks on the Quick Start Setup page: a. In the Management Configuration area, enter the IP address of the Domain Name Service (DNS) server. Enter the IP address or host and domain name of the Network Time Protocol (NTP) server and select your time zone. If you do not use NTP, you can enter a time manually on the Setup page. Refer to About System Setup, Configuration, and License Management on page 66. b. If this is the first Palo Alto Networks firewall for your company, click the Support link and register the firewall. If you have already registered a firewall, you have received a user name and password and the license authorization code for any optional features. Enter these on the page. Use a space to separate multiple authorization codes. c. Select the Update Application and Threat Content check box to automatically update the firewall with the latest application and threat data. Select the Update Software check box to update the firewall with the latest available software. d. Click Proceed to apply the settings and close the page. 7. Click Administrators under the Devices tab. 8. Click admin. 9. In the New Password and Confirm New Password fields, enter and confirm a casesensitive password (up to 15 characters). 18 Getting Started Palo Alto Networks

21 Using the Firewall Interface 10. Click OK to submit the new password. Using the Firewall Interface Figure 2 shows the firewall web interface. Figure 2. Firewall Web Interface Palo Alto Networks Getting Started 19

22 Using the Firewall Interface The following conventions apply when using the firewall interface. To display the menu items for a general functional category, click the tab, such as Object or Devices, near the top of the browser window. Click an item on the side menu to display a panel. To display submenu items, click the icon to the left of an item. To hide submenu items, click the icon to the left of the item. On most configuration pages, you can click New to create a new item. To delete one or more items, select their check boxes and click Delete. In most cases, the system prompts you to confirm by clicking OK or to cancel the deletion by clicking Cancel. On some configuration pages, you can select the check box for an item and click Clone to create a new item with the same information as the selected item. 20 Getting Started Palo Alto Networks

23 Using the Firewall Interface To modify an item, click its underlined link. After you configure settings, you must click OK or Save to store the changes. When you click OK, the current candidate configuration is updated. Clicking Commit at the top of the page applies the candidate configuration to the active configuration, which activates all configuration changes since the last commit. For more information about committing changes, refer to Managing Configurations on page 72. To view help information on a page, click the icon in upper right area of the page. Navigating to Configuration Pages Each configuration section in this guide shows the menu path to the configuration page. For example, to reach the Vulnerability Protection Profiles page, choose the Objects tab and then choose Vulnerability Profiles under Security Profiles in the side menu. This is indicated in this guide by the following path: Objects > Security Profiles > Vulnerability Profiles Palo Alto Networks Getting Started 21

24 Using the Firewall Interface 22 Getting Started Palo Alto Networks

25 Chapter 3 Device Management This chapter describes how to perform basic system configuration and maintenance for the firewall and includes overviews of the virtual systems, high availability, and logging functions: About Virtual Systems in the next section About High Availability on page 28 About User Identification Agents on page 33 About Administrator Roles, Profiles, and Accounts on page 53 About Authentication Profiles on page 54 About the Firewall Logs on page 60 About System Setup, Configuration, and License Management on page 66 Defining Custom Response Pages on page 74 Upgrading the PAN-OS Software on page 75 Updating Threat and Application Definitions on page 76 Importing, Exporting and Generating Security Certificates on page 77 Viewing Support Information on page 80 Palo Alto Networks Device Management 23