PaloAlto Networks PA-200 User manual

www.paloaltonetworks.com
Copyright ©2011-2017 Palo Alto Networks. All rights reserved.
Palo Alto Networks and PAN-OS are trademarks of Palo Alto Networks, Inc.
Part Number 810-000072-00B
Performing the Final Setup
CONFIGURING THE SECURITY POLICY
Click Policies > Security.
Review the default policies, which allow all traffic to flow from the trust zone to the
untrust zone while inspecting for viruses, vulnerability, and spyware. In addition, the
default policies deny the flow of traffic from the untrust zone to the trust zone.
DEPLOYING THE DEVICE AND VERIFYING THE NETWORK AND SECURITY
CONFIGURATION
Connect port 1 to the Internet.
Connect port 2 to your local network.
From a computer on your local network other than the computer you are using
to configure the PA-200 device, try to connect to the Internet to validate proper
connectivity.
CONFIGURING THE MANAGEMENT INTERFACE
Click Device > Setup. Click the Edit button of the first table (top right).
Enter the new MGT interface information for accessing the enterprise management
network. Click OK. Click Commit.
Disconnect your computer from the PA-200 device.
Connect the MGT port on the device to the enterprise management network.
VERIFYING THE MANAGEMENT CONFIGURATION
Connect your computer to the enterprise management network.
Open a browser window and type https://<MGT_port_IP_Address>.
Log in to the web interface of the PA-200 device.
Where to Go Next
•To learn about device administration, refer to the Palo Alto Networks Administrator’s
Guide.
•To learn about the CLI, refer to the PAN-OS™Command Line Interface Reference Guide.
•To obtain a detailed description of the LEDs on a PA-200 device, refer to the
PA-200 Hardware Reference Guide.
Before You Begin
•Register your PA-200 device at http://support.paloaltonetworks.com to obtain the
latest software and App-ID updates, and to activate support or subscriptions.
•Obtain an IP address from your network administrator for configuring the
management port on the PA-200 device.
•Have an RJ-45 Ethernet cable to connect your computer to the management port on
the PA-200 device.
•Set your computer’s IP address to 192.168.1.2 and the subnet mask to 255.255.255.0.
NOTE: This card assumes the device has been properly rack-mounted and powered up as
described in the PA-200 Hardware Reference Guide.
Performing the Initial Setup
Connect your computer to the management port (MGT) using an RJ-45 Ethernet cable.
Turn your computer on.
Launch the Internet browser on your computer and enter https://192.168.1.1.
The login page of the PA-200 management console appears.
Type admin in both the Name and Password fields.
Click Login.
Click Device > Administrators > admin.
Type the old password in the Old Password field.
Type the new password in the New Password field.
Type the new password again in the Confirm New Password field.
Click OK.
Proceed to the next section to choose a deployment option.
1
2
3
4
5
6
7
8
9
10
11
12
1
2
3
4
5
6
7
8
9
10
11
PA-200
Quick Start

OPTION A VIRTUAL WIRE DEPLOYMENT
The default configuration of the PA-200 device is a virtual wire between ports 1 and
2, which enforces security policies. No configuration is required for this basic setting.
Proceed to “Performing the Final Setup.”
OPTION B LAYER 2 DEPLOYMENT
CONFIGURING THE INTERFACES
Click Network > Interfaces.
Click ethernet1/1, choose Layer2 from the drop-down menu, and then click OK.
Click ethernet1/2, choose Layer2 from the drop-down menu, and then click OK.
CONFIGURING THE SECURITY ZONES
Click Network > Zones and then click trust. Choose Layer2 from the Type drop-down box.
Check the check box for ethernet1/2 and then click OK.
Click untrust. Choose Layer2 from the Type drop-down box.
Check the check box for ethernet1/1 and then click OK.
CONFIGURING THE VLANS
Click Network > VLANs and then click New. Type the name of the VLAN in the Dot1q
VLAN Name field.
Check the check boxes for the ethernet1/1 and ethernet1/2 in the Interfaces list, and
then click OK.
Click Commit and then proceed to “Performing the Final Setup.”
OPTION C LAYER 3 DEPLOYMENT
CONFIGURING THE INTERFACES
Obtain two IP addresses for ports 1 and 2 on the PA-200 device from your network
administrator.
Click Network > Interfaces.
Click ethernet1/1 and choose L3 from the drop-down menu.
Enter the IP address and subnet mask (for example, 10.1.1.1/24) for port 1 in the IP
Address and Subnet Mask field.
Click Add and then click OK.
Click ethernet1/2 and choose L3 from the drop-down menu.
Type the IP address and subnet mask (for example, 10.1.2.1/24) for port 2 in the
IP Address and Subnet Mask field.
Click Add and then click OK.
CONFIGURING THE SECURITY ZONES
Click Network > Zones and then click trust.
Choose Layer3 from the Type drop-down box.
Check the check box for ethernet1/2 and then click OK.
Click untrust.
Choose Layer3 from the Type drop-down box.
Check the check box for ethernet1/1 and then click OK.
CONFIGURING THE VIRTUAL ROUTERS
Click Network > Virtual Routers and then click New.
Type the name of the virtual router in the Virtual Router field.
Check the check boxes for the ethernet1/1 and ethernet1/2 in the Interfaces list.
Enter network definition in the IP Address/Mask field and the gateway IP in the
Next Hop IP field to configure the static route, and click Add.
Add more static routes as necessary, and click OK when finished.
Click Commit and then proceed to the next section.
Choosing a Deployment Option
•OPTION A: Virtual Wire deployment —Choose this option to transparently place the
PA-200 device between two ports where no routing, switching, or NAT is required.
•OPTION B: Layer 2 deployment — Choose this option to deploy the PA-200 device in
a Layer 2 environment where switching is required.
•OPTION C: Layer 3 deployment — Choose this option to deploy the PA-200 device in
a Layer 3 environment where routing and NAT are required.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
1
2
3
4
5
6
7
8
9
10
20