For this chapter, a basic understanding of network appliances is required as we will be looking at physically connecting to a device, configuring the management environment, and choosing the data plane interface’s deployment mode. Basic knowledge of standing up a virtual appliance in a virtual environment, including connecting it to virtual switches or virtual interfaces and providing it with network access on a hypervisor, is also required.

When taking a new device out of the box or setting up a VM on a local hypervisor, such as VMware ESXi, Fusion, NSX, Hyper-V, KVM, and so on, one of the first things that needs to be accomplished is making it possible to gain access to the user interface, be it a web interface or a console connection. We’ll go over the most common ways of gaining this access in this section.

One of the first things you may need to do is to connect a console cable to gain access to the command-line interface (CLI). Older models only come with an RJ45 console port, so for those, you will need a standard DB9-to-RJ45 console cable, optionally patched through a serial-to-USB cable so a modern laptop is able to interface with the port. The pinout for the DB9 should be as follows:

1 - Empty - Data Carrier Detect...

Before we can start adding licenses, the device needs to be registered. You will need to note down the device’s serial number or, if you do not have a support portal account, the sales order number to create a new account. The sales order number will typically be sent to you by your distributor or reseller after you’ve placed your order.

Open a new tab or browser and navigate to https://support.paloaltonetworks.com. If you do not have an account yet, you will first need to create a new one so that you can gain access to the portal from where you will be able to manage all your devices, activate your licenses, download software packages and updates, and access support cases. If you already have a Customer Support Portal (CSP) account, you can skip to Registering a new device.

Creating a new account

When creating a new account, you will be asked for an email address and whether you want to register using a serial...

In this section, you will learn how to upgrade your firewall and what steps need to be taken to ensure a smooth process. We will review important information to keep in mind when preparing your maintenance window and providing a contingency plan. In-depth upgrade procedures are provided in Chapter 9, Upgrading Firewalls and Panorama.

Understanding the partitions

Before we start the upgrade procedure, there’s an important bit of information you need to know. Like most Linux systems, the hard disk has been partitioned into specific segments. These segments serve a specific purpose.

A few important ones are as follows:

• / is the root partition, which is where the operating system is installed
• /opt/pancfg is where the configuration files and dynamic update files are kept
• /opt/panrepo is the repository for downloaded operating system (PAN-OS) images
• /opt/panlogs is the partition where logdatabase is stored

There...

When you open the Network | Interfaces menu, you will see an assortment of physical interfaces. There are several different interface types that will cause an interface to behave in a specific way. We will first cover the four basic interface types and continue with the more specialist ones after:

• Virtual Wire (VWire) is a “Layer 1” passthrough set of two interfaces
• Layer 3 is routed interfaces
• Layer 2 is “switched” interfaces that rely on VLAN tags rather than routing tables
• Tap is a “sniffing” interface

Let’s discuss them in more detail.

VWire

Just as the name suggests, VWire is intended to be a “bump in the wire.” VWire always consists of two physical interfaces—no more and no less. There is no low-level interference with VLAN tags and there are no routing options; packets are inspected in flow.

Using a VWire interface can be...

In this chapter, you learned how to create a support account, register a new device, and add licenses. You are now able to identify all the different support licenses and select the appropriate subscription licenses to address your needs. You can upgrade and update a device so that its firmware is up to date and the latest application and threat signatures are loaded to protect the network. You learned how to protect the management interface so that only legitimate users can connect, and you can assign different accesses and privileges to administrators. You are able to configure all the physical interfaces, like Layer 3 and VWire, and know when each is most appropriate. You can also leverage logical interfaces like tunnel interfaces and loopback interfaces when they are needed.

If you’re preparing for the PCNSE, you should take note that upgrading requires the base image to be downloaded before you can move forward to a maintenance release. The recommended threshold...