Getting started with the APIs from Palo Alto Ntwks

API, Palo Alto Networks, , , , ,

You can talk to firewalls and Panorama from Palo Alto Networks in various ways. The well-known GUI (which I really love, by the way) and the CLI are quite common at first glance. Nearly everyone using the Palos is familiar with these configuration options.

When it comes to automation at some point, either to configure those devices or just to read out some KPIs for your monitoring, APIs are in place. Plural because Palo has two APIs: The so-called “XML API” and the “REST API“. Let’s get started with both of them:

Continue reading Getting started with the APIs from Palo Alto Ntwks →

iPad Ping: WLAN vs. LAN

Bandwidth/Delay, Internet Access, iPhone/iPad, Ping/Traceroute, WLAN/Wi-Fi, , , , , , ,

Meine Kids spielen derzeit häufig Brawl Stars, ein Echtzeit Onlinespiel. Und sie schauen auch immer mal Videos dazu, bei denen ihnen jetzt der Floh ins Ohr gesetzt wurde, dass man ein iPad ja auch per LAN-Adapter mit einem Netzwerkkabel ausstatten kann, was ja den Ping verbessert.

JAAAA, endlich waren meine Kenntnisse in Sachen Netzwerktechnik mal von meinen Kindern gefragt. “Papa, weißt du, was ein LAN-Kabel ist?” “Ja klar.” “Hast du so eines?” “Ja, circa Hundert.” “Waaas? Echt jetzt? Dann muss ich mir ja gar keins kaufen.” 😂

Neben der Subjektivität, ob das Zocken per LAN-Kabel jetzt merklich besser wird, wollte ich mal objektiv messen, wie sich die Latenz eines per Ethernet-Adapter angeschlossenen iPads denn nun wirklich verhält. Wie viel besser wird der Ping im Idle- bzw. im Volllastfall? Was sagt die Laufzeit zum Default Gateway? Hier ein paar Tests:

Continue reading iPad Ping: WLAN vs. LAN →

PANW: Dynamic Routing between Logical Routers

Palo Alto Networks, Routing, , , , , ,

How to route traffic between multiple logical routers aka Inter-LR Routing on a Palo Alto Networks Strata firewall? More precisely, inclusive route redistribution rather than a few static routes. –> Via iBGP through loopback interfaces. ✅ Let’s go:

Continue reading PANW: Dynamic Routing between Logical Routers →

BGP Route Filtering with Palo’s Advanced Routing Engine (ARE)

Palo Alto Networks, Routing, , , , , ,

With PAN-OS 10.2, Palo Alto Networks has introduced the “Advanced Routing Engine” (ARE) with its “Logical Routers” (LR) rather than the legacy “Virtual Routers” (VR).

The Advanced Routing Engine simplifies operations with a standards-based configuration, which reduces your learning curve since it is similar to that of other router vendors.

The neat thing, as always: You can configure everything through the GUI. Here’s a basic example of how I’m using a prefix list to filter incoming BGP routes:

Continue reading BGP Route Filtering with Palo’s Advanced Routing Engine (ARE) →

Misusing Palo’s Captive Portal as a Guest Wi-Fi Welcome Page

Authentication, Internet Access, Palo Alto Networks, WLAN/Wi-Fi, , ,

I was faced with an interesting customer requirement: An existing guest Wi-Fi should be prefaced with a welcome page for accepting the terms and conditions. Since there was already a Palo Alto Networks firewall in place, could we perhaps use its captive portal directly for this purpose? It’s not about authenticating the users, but only for a single webpage with a simple check button that should appear once a month per device.

TL;DR: While we were able to redirect every device to a welcome page, we were not able to extend the lifetime of those sessions to longer than 24 hours. This might fit for short-term guest Wi-Fis, but is not appropriate for long-term connections aka BYOD. However, this is how we have done it:

Continue reading Misusing Palo’s Captive Portal as a Guest Wi-Fi Welcome Page →

Dynamic DNS on a Palo

DNS/DNSSEC, Internet Access, Palo Alto Networks, , , , ,

With PAN-OS 9.0 (quite some time ago), Palo Alto Networks has added Dynamic DNS for a firewall’s interfaces. That is: If your Internet-facing WAN interface gets a dynamic IP address via DHCP or PPPoE (rather than statically configured), the firewall updates this IP address to a configured hostname. The well-known DynDNS providers such as Dyn (formerly DynDNS), No-IP, or FreeDNS Afraid are supported. Since the Palo supports DHCP, PPPoE (even on tagged subinterfaces) as well as DHCPv6 respectively PPPoEv6, we can now operate this type of firewall on residential ISP connections AND still access it via DNS hostnames. Great. Let’s have a look at the configuration steps.

Spoiler: The DynDNS feature on a Palo only supports static IPv6 addresses rather than dynamic ones. 🤦🤦🤦 Yes, you haven’t misread. The DYNAMIC DNS feature does not support DYNAMIC IP addresses, but only STATIC ones. D’oh!

Continue reading Dynamic DNS on a Palo →

Akustikdämmung im Büro

DIY/Bastelarbeiten, Off-Topic, , , , ,

Als Consultant im Homeoffice mache ich vor allem eins: Telefonieren und an Videokonferenzen teilnehmen, neudeutsch: Calls. Und es nervt mich total, wenn mein Gegenüber einen schlechten Ton hat. Also akutisch. Das verbaute Mikrofon im Notebook oder irgendwelche Raummikros gehen gar nicht. Gleichermaßen möchte ich selber auch nicht viele Stunden am Tag ein Headset aufhaben.

Was hilft: Ein Podcast-Mikrofon und eine gute Raumakustik, sprich: wenig Hall. Um letzteres habe ich mich die letzten Wochen gekümmert. Hier mein Erfahrungsbericht, Tonaufnahmen und Messergebnisse.

Continue reading Akustikdämmung im Büro →

Palo’s Mgmt-Intf is not usable with IPv6 anymore

IPv6, Palo Alto Networks, , ,

Wow, that was unexpected: With PAN-OS 11.1 the out-of-band management interface of Palo Alto Networks firewalls doesn’t accept an IPv6 default route pointing to one of its own data interfaces anymore. That is: In most setups, you can’t use IPv6 for management purposes anymore. “Works as expected.” Wow. Really?

Continue reading Palo’s Mgmt-Intf is not usable with IPv6 anymore →

How to install Palo Alto’s PAN-OS on a FortiGate

Fortinet, Palo Alto Networks, Tutorial/Howto, , , ,

It happens occasionally that a customer has to choose between a Palo and a Forti. While I would always favour the Palo for good reasons, I can understand that the Forti is chosen for cost savings, for example.

Fortunately, there is a hidden way of installing PAN-OS, the operating system from Palo Alto Networks, on FortiGate hardware firewalls. Here’s how you can do it:

Continue reading How to install Palo Alto’s PAN-OS on a FortiGate →

Optimized NAT46 Config on a FortiGate

Fortinet, Internet Access, IPv6, NAT, Tutorial/Howto, , , , ,

Johannes published a basic NAT46 configuration for a Fortigate firewall with FortiOS 7.0 some time ago. I run such a service (legacy IPv4 access to IPv6-only resources) since FortiOS 5.6, which means more than six years; lastly with FortiOS 6.4. It’s running for more than 100 servers without any other problems as we see them with IPv4 only or dual stack services.

But we weren’t happy with the basic configuration example by Fortinet. We wanted some NAT46 sample configuration with more details, that is: including the original source IPv4 address within the synthesized/SNATted IPv6 address. More in this post, after a short story about my way to a running nat46 configuration with port forwarding in FortiOS 7.2.x.

Continue reading Optimized NAT46 Config on a FortiGate →

DHCPv6 Prefix Delegation on Palo Alto’s NGFW

DHCP/DHCPv6, IPv6, Palo Alto Networks, , , , ,

Finally! With PAN-OS 11.0 a long missing IPv6 feature was introduced: DHCPv6-PD aka prefix delegation. For the first time, we can now operate a PAN-OS firewall directly on the Internet (the IPv6-Internet that is) on many kinds of ISP connections. Remember: To get a routed IPv6 prefix requires DHCPv6-PD (if you’re not a BGP-homed enterprise). Hence, without that feature, we could not connect to the Internet with a Palo directly.

With DHCPv6-PD, the firewall can receive a prefix from the ISP (commonly a /48 or a /56), while handing out /64s to downstream layer 3 interfaces. Here we go:

Continue reading DHCPv6 Prefix Delegation on Palo Alto’s NGFW →

DHCPv6 Prefix Delegation

DHCP/DHCPv6, IPv6, , , , , , ,

What is DHCPv6 Prefix Delegation? Coming from IPv4, you’re already familiar with DHCP (for IPv4) which hands out IPv4 addresses to clients. The same applies to (stateful) DHCPv6: it hands out IPv6 addresses to clients.

However, with IPv6 we’re heavily dealing with subnets rather than just single addresses. Again, you’re familiar with IPv4: For an IPv4-based ISP connection, you’re getting either a single public IPv4 address or a small subnet such as a /29, /28, or the like for your WAN interface. For an IPv6-based ISP connection, you’re getting a subnet which includes multiple unique subnets to be used for other layer 3 segments rather than a single address (with NAT on the CPE). This is where DHCPv6 prefix delegation (commonly abbreviated as DHCPv6-PD) kicks in: It hands out IPv6 subnets to routers.

Let’s have a closer look:

Continue reading DHCPv6 Prefix Delegation →

More Capture Details III

Network, , , , , , , , , , , ,

Another update of the Ultimate PCAP is available. Again, there are some special new packets in there which I want to point out here. Feel free to download the newest version to examine those new protocols and packets by yourself. Featuring: SNMPv3, WoL, IPMI, HSRP, Zabbix, Pile of Poo, and Packet Comments. ✅

Continue reading More Capture Details III →