Posts tagged "firewall"
How to install PA firewall device certificate for Panorama managed devices
Palo Alto device certificates are required for devices that need to communicate with Palo Alto cloud services. There are two ways to install them - one is directly from the firewall itself, while the other one is for Panorama managed devices.
3 min readInstall Palo Alto GlobalProtect to use default browser for SAML
There is a 'funny' situation when installing Palo Alto GlobalProtect client for RA VPN. If you are using SAML to authenticate your users, with the default installation it will use builtin browser to open SAML IdP.
1 min readOpenConfig plugin on Palo Alto FWs - how to delete it
I ran into an interesting problem recently - one of the firewalls I manage had to be upgraded, but the problem immediately showed up when I tried doing an image upgrade: I went to Device -> Plugins and there was the perpetrator openconfig-2.0.0 plugin that was installed. I tried removing the config
1 min readConfigure Palo Alto Cloud Identity Engine to use Authentik as IdP
Cloud Identity Engine (CIE) is a cloud-based service designed to simplify identity and access management across different environments, including on-premises, cloud, and hybrid setups.
7 min readPalo Alto FW can't download software with proper licensing applied
We recently had a situation where firewall was complaining that it can't download software anymore with an error message An active license is required for this feature. Firewall was properly licensed and it was synced with the license server, but for some reason, it was still complaining about it.
1 min readPalo Alto FW IP-tagging
IP-tag functionality on Palo Alto Firewalls allows administrators to apply custom labels or tags to IP addresses or ranges. These tags serve various purposes, such as simplifying policy creation and management by grouping similar IP addresses together under a single tag. Additionally, IP-tagging ena
6 min readPalo Alto SAML SSO with authentik
Palo Alto network appliances natively support SAML and can leverage providing identity to a SAML Identity Provider. This can be very useful in multiple ways - granting access to admin GUI interface, authenticating users for GlobalProtect (remote access VPN) and Captive Portal user authentication are
12 min readHow to configure PA FW as NTP proxy
There is a nice functionality on PA firewalls called DNS Proxy. It basically allows PA FW to act as an DNS proxy for hosts that will use its interface address for DNS queries. The way it works is that you configure it in the GUI by configuring primary and secondary servers and then you point your ho
4 min readPalo Alto FW loopback interface routing
Recently I started deploying loopbacks on all of my network devices that are somehow participating in routing and I hit a momentary roadblock when I realised that none of my loopbacks configured on firewalls are being advertised via iBGP. The reason for that is because all loopback interfaces are c
1 min readStarting a homelab - Part 05 - Virtualise Your Firewall
Video of the whole process is available on Youtube: Today we will continue our journey with building a homelab. Unfortunately, I was too busy in the past year and there's been a lot of changes to my own homelab environment as well. One of the things that has changed is my own server infrastructure
13 min read