讲义课件教程pan-edu20161b mod3basic interface config

1、Basic Interface ConfigurationPAN-EDU-201PAN-OS 6.1Rev BAgendaSecurity ZonesInterface TypesTap ModeDecryption Mirror Virtual WireLayer 2Layer 3Virtual RouterIP AddressingDHCPLoopbackAggregateInterface Management Profile2Flow Logic of the Next-Generation FirewallInitial Packet ProcessingSource Zone/ A

2、ddress/ User-IDPBF/ Forwarding LookupDestination ZoneNAT PolicyEvaluatedSecurity Pre-PolicyCheck Allowed PortsSession CreatedApplicationCheck for Encrypted TrafficDecryption PolicyApplication Override PolicyApp-IDSecurity PolicyCheck Security PolicyCheck Security ProfilesPost Policy ProcessingRe-Enc

3、rypt TrafficNAT Policy AppliedPacket Forwarded3Security ZonesSecurity ZonesSpecify Zone NameSelect Zone TypeAssign InterfaceNetwork Zones Add5Security Zones and PoliciesSecurity Policies use Zones to regulate and log trafficIntra-zone traffic is allowed by defaultInter-zone traffic is denied by defa

4、ult6Security Zone Interfaces An Interface is configured to one zone onlyA Security Zone can have multiple InterfacesInterfaceZoneAddressE 1/10Internet54E 1/11DMZ54E 1/12-E 1/12.10Users54E 1/12.20Users54E 1/12.30VoIP54Tunnel.4Remote-LAN547Interface TypesInterface TypesEthernetTapHAVirtual WireLayer 2

5、Layer 3AggregateVLANLoopbackTunnelDecrypt MirrorNetwork Interfaces9Ethernet Interface ConfigurationInterface Type: TapHA Virtual WireLayer 2Layer 3Decrypt MirrorAggregateLayer 3V-WireNetwork Interfaces EthernetLayer 210Flexible Deployment Options For Ethernet InterfacesTap ModeVirtual Wire ModeLayer

6、 3 ModeApplication, user and content visibility without inline deploymentEvaluation and Audit of existing networksApplication ID, Content ID, User ID, SSL DecryptionIncludes NAT capabilityAll of the Virtual Wire Mode capabilities with the addition of Layer 3 services: Virtual Routers, VPN and, Routi

7、ng Protocols11Ethernet Tap ModeTap mode deployment allows the capability to passively monitor traffic flows across a network by way of a switch SPAN or mirror portFirewall cannot perform traffic shaping or blockingMust be assigned to a security zone for ACC and Reporting capabilitiesLANInternetSPAN

8、PortE1/112Configuring Tap Interfaces Network Interfaces EthernetSecurity ZoneInterface Type13Ethernet Virtual Wire InterfaceBinds two physical interfaces togetherSupports App-ID, Decryption, NAT, Content-ID, and User-IDTypically used when no switching or routing is neededNo configuration changes for

9、 adjacent network devicesInternet14Configuring a Virtual Wire ObjectA Virtual Wire can allow or block traffic based on 802.1Q VLAN tags0 = untagged trafficApplies security rules to multicast traffic, enables Multicast Firewalling802.1Q Tags allowedEnable Multicast AddressesNetwork Virtual Wires Add1

10、5Configuring Virtual Wire InterfacesNetwork Interfaces EthernetSecurity ZoneVirtual Wire ObjectInterface Type16V-Wire SubinterfacesProvides flexibility in setting distinct policies when needed to manage traffic from multi-tenancy networksThe sub-interfaces allows for the assignment of ing traffic to

11、 different ingress and egress Security Zones by either:VLAN tags or VLAN tags and IP classifiers (source IP)Traffic from different VLANs can now be assigned to different Zones and then managed by different Security PoliciesTraffic from different VLANs can be assigned to different portsVoice VLAN can

12、 be assigned to one port, and Data VLAN to another17Configuring a Virtual Wire SubinterfaceNetwork Interfaces Ethernet Add Subinterface18Layer 2 and Layer 3 InterfacesE1/3E1/4InternetE1/3E1/4/24Switching between network segmentsRouting between networksLayer 2Layer 3E1/5App Servers(/24)Mail Servers(/

13、24)/24UsersDMZE1/5/24LAN(/24)19Layer 2 Interface ExampleLayer 2 Interfaces are useful for a flat networkPN FW0000Eth1/1L2Eth1/2L2Eth1/3L2VLANPA-FW20VLAN ConfigurationNetwork VLANs AddPhysical Layer 2 Interfaces and Layer 2 Subinterfaces in the VLAN ObjectsVLAN Object Name21Layer 2 Interface Configur

14、ationNetwork Interface22Layer 2 SubinterfacesNetwork Interfaces Ethernet Add SubinterfaceLayer 2 ZonePhysical InterfaceSubinterface ID802.1Q Tag23VLAN InterfacesVLAN Interfaces allow VLANS to connect to Layer 3 Networks0000Eth1/1L2Eth1/2L2Eth1/3L2VLANEth1/8L3VRVLAN IntPA-FWInternet5424Configuring a

15、VLAN InterfaceNetwork Interfaces VLAN AddThis is NOT a sub-interfaceIt does NOT reference traffic tagged with VLAN ID 1VLAN object associated with this VLAN interface25Configuring a Layer 3 InterfaceInterface Type: Layer 3Virtual RouterA Virtual Router contains a set of static and dynamic routers us

16、ed by a specified group of interfacesSecurity ZoneIP addressStatic or DHCP ClientDHCP Server or DHCP RelayInterface management profileAllows or denies management protocols like SSH and HTTP on the interfaceNetwork Interfaces Ethernet26Configuring a Layer 3 InterfaceSecurity ZoneInterface Type: Layer

17、 3Virtual RouterInterface management profileIP addressNetwork Interfaces Ethernet27Configuring a Layer 3 SubinterfaceNetwork Interfaces Add SubinterfaceSecurity ZoneVirtual RouterDefine management profileSubinterface IDPhysical Interface802.1Q TagIP Address28Virtual RoutersAll interfaces assigned to

18、 a Virtual Router share the same routing tableThe routing table of a Virtual Router is defined by static and dynamic (RIP, OSPF, BGP) routesAllows for the configuration of different routing behavior for different interfacesNetwork Virtual Routers29Multiple Virtual RoutersVLAN10VLAN20VLAN30VLAN40VR1V

19、R2L3InternetInternet30Virtual Router Static RoutesNetwork Virtual Routers31Virtual Router Dynamic RoutesStandards based support for:OSPF v2 and v3RIP v2BGP v4Routing support across IPsec tunnelsMulticast Routing support for:PIM-SMPM-SSMIGMPNetwork Virtual Routers32Policy-Based Forwarding (PBF)Supers

20、edes the forwarding information in the virtual routerReverts to the virtual router table if the PBF policy destination is unreachableA single session is forwarded by the PBF policy the same waySourceSource addressSource zoneSource userDestinationDestination addressDestination applicationDestination

21、service (port number)33Assigning an IP Address to an InterfaceNetwork Interfaces Ethernet34IPv6 CapabilitiesSupport forIPv6 Layer 3 interfacesIPv6 addresses in all policy IPv6 static routes in virtual routersICMPv6 supportDHCPv6 Neighbor DiscoverDual StackSLAACLDAPRADIUSDevice Setup Session Session

22、Settings35IPv6 | Feature MatrixFeatureIPv6 SupportTraffic Classification and Threat Prevention App-IDY Content-IDY User-IDY DoS RulebaseY Zone ProtectionYNetworking Static RoutingY Dynamic Routing (OSPFv3)Y PBFY NAT (NAT64 only)Y IPsec VPNN SSL VPNN IPv6 over IPv4 IPsec tunnelY DNS ProxyY36IPv6 Inte

23、rface Configuration Network Interfaces EthernetDual Stack SupportYou can have both IPv4 and IPv6 addresses on the same interface37DHCP Server Network DHCP DHCP Server. When an interface is configured as a DHCP server, it will assign addresses to DHCP clients.If an interface on the firewall is a clie

24、nt of an external DHCP server, the DHCP Server can forward information to its own clients38DHCP RelayRelay DHCP requests to up to four external DHCP serversNetwork DHCP DHCP Relay39Configuring Loopback InterfacesNetwork Interfaces LoopbackLoopback Interface IDSecurity ZoneVirtual RouterIP Address40A

25、ggregate InterfacesAn aggregate interface group combines up to 8 Ethernet interfaces using link aggregationIncreased throughput and link redundancyThe aggregate interface is a logical interface that can be configured as if it were a regular interfaceLACP is supported41Create an Aggregate InterfaceNetwork Interfaces Ethernet Add Aggregate GroupStep1: Create the Aggregate