Linking Active Directory to Palo Alto

 ###First you need to create a server profile under the LDAP section.

DEVICE>Server Profiles>LDAP then click on the Add down at the bottom of the page.

Fill in the required information:

Profile Name ###the name of this LDAP object your creating

Server List ###This is inputting the DNS name, LDAP server IPs, and the port number information

##For port info, 389 and 636

Server Settings:

Type: active-directory

Base DN: DC=LAB,DC=LOCAL (stands for lab.local, or whatever your domain is)

Bind DN: svc.acct@lab.local (whatever your service account name is)

Password: Service account password

Confirm Password: confirm it

Bind Timeout: 30

Seach Timeout: 30

Retry Interval: 60

If you click on "Require SSL/TLS secured connection" it will try and force encryption when available

###Next, you can create an Authentication Profile to associate with user accounts.

DEVICE>Authentication Profiles>then click Add at the bottom of the page.

Authentication Profile Settings:

Under Authentication, fill out the following:

Type: LDAP

Server Profile: YOUR_SERVER-PROFILE

Login Attribute: sAMAccountName

Password Expiry Warning: 7

User Domain: lab.local

Username Modifier: %USERINPUT%

Leave Factors tab alone

Then for to Advanced Tab

Allow List: Click Add

Select all to ensure all users are applied

###Now you can go to Administrators and add admins and associate them to the Authentication Profile

DEVICE>Administrators>Add or click on a user you want to work with

On Authentication Profile, click the drop down and then select the profile you setup from the previous step.

This user can now use their AD account to login.

Basic Palo Alto FW Commands

• Show VLANs on a Palo Alto

o uname@FW-Name(active)# show network interface vlan

• Show Interfaces on Palo Alto

o uname@FW-Name(active)# show network interface Ethernet

• Basic show logging of traffic on PA

o uname@FW-Name(active)# show log traffic src in x.x.x.x receive_time in last-hour dport equal 443

• Show NAT policies on a PA

o >show running nat-policy

• Show DHCP configuration info for PA

o >conf t

o #show network dhcp interface vlan.your-vlan relay

• PA privilege mode is with the > sign.

• Config mode for a PA is with the # sign

Palo Alto Graceful Shutdown

Via GUI:

•    Click on Device tab > Setup link > Operations tab
•    Click on shutdown device under device operations on the right hand side
•    Click Yes on the confirmation pop-up
•    Wait a few minutes for the process to complete.

Via CLI

•    Issue the command: “request shutdown system”
    o    >request shutdown system
    o    Warning: executing this command will leave the system in a shutdown state. Power must be removed and reapplied for the system to restart. Do you want to continue? (y or n) y
•    Wait until “System Halted” is displayed on the console.