Firewall - Paloalto

1. Enable Interface E1/1 WAN , E1/2 LAN  

CLI

> configure

    # set network interface ethernet ethernet1/1 layer3

    # set network interface ethernet ethernet1/1 layer3 dhcp-client enable yes

    # set network interface ethernet ethernet1/1 layer3 dhcp-client create-default-route yes

2. Enable interface E1/2, 

> configure

    # set network interface ethernet ethernet1/2 layer3

    # set network interface ethernet ethernet1/2 layer3 ip 192.168.10.1/24

3. สร้าง Security Zone

Zone       Interface               ความหมาย

    

Untrust    ethernet1/1          Internet
Trust       ethernet1/2          LAN ภายใน

GUI ไปที่ Network -> Zones (ปุ่ม Add ด้านล่าง)

> configure

    # set zone Trust network layer3 ethernet1/2

    # set zone Untrust network layer3 ethernet1/1


4. Configure Virtual Router ทำหน้าที่ Routing ระหว่าง Network

> configure

    # set network virtual-router default interface ethernet1/1

    # set network virtual-router default interface ethernet1/2

    # commit
    # exit 

 > show routing route

ควรพบ Default Route: 0.0.0.0/0



5. Configure Security Policy ให้ Client ใน LAN สามารถออก Internet ได้

#configure

>
set rulebase security rules LAN-to-Internet from Trust

set rulebase security rules LAN-to-Internet to Untrust

set rulebase security rules LAN-to-Internet source any

set rulebase security rules LAN-to-Internet destination any

set rulebase security rules LAN-to-Internet application any

set rulebase security rules LAN-to-Internet service application-default

set rulebase security rules LAN-to-Internet action allow

set rulebase security rules LAN-to-Internet log-end yes

6. Configure Source NATแปลง Private IP ของ Client ให้เป็น IP ของ WAN Interface เพื่อให้ออก Internet 

> configure

set rulebase nat rules LAN-to-Internet-NAT from Trust

set rulebase nat rules LAN-to-Internet-NAT to Untrust

set rulebase nat rules LAN-to-Internet-NAT source any

set rulebase nat rules LAN-to-Internet-NAT destination any

set rulebase nat rules LAN-to-Internet-NAT service any

set rulebase nat rules LAN-to-Internet-NAT source-translation dynamic-ip-and-port interface-address interface ethernet1/1

> Commit

show interface all

show routing route

show zone

show running nat-policy

show running security-policy