We all know Palo Alto Network Firewalls offers quite flexibility deployment options, one can also deploy Palo Alto Networks in Virtual Wire or V-Wire mode. This is the beauty of Palo Alto Networks Firewalls , the flexibility it offers cannot be matched by some of the leading firewall vendors. Though other vendors offers the same feature better known as transparent firewalls.
Virtual Wire mode can be deployed by pairing a set of two physical interfaces into a single set and in V-Wire mode one does not needs to assign either an IP Address or a mac address. Virtual Wire is also referred to as a “Bump in the Wire” of “Transparent In-Line”. By default certain Palo Alto Networks Firewalls comes with preconfigure Virtual Wire mode and Ethernet ports 1 and 2 are part of that default V-Wire.
These kinds of deployment comes very handy, especially when one does not wants to do any kind of switching or routing and simply wants to plug and play with the Palo Alto Networks firewall. The biggest value Palo Alto Networks offers in Virtual Wire mode is, it supports features like App-ID, decryption , Content-ID , User-ID and NAT by using all these features one can certainly inspect the traffic passing through Virtual Wire and can apply the security policy. In upcoming post lets configure a Palo Alto Firewall in Virtual -Wire Mode and see how it works.
In one my recent post we discussed what is TAP mode in Palo Alto Networks Firewall and the flexibility it offers when it comes to deployment.
I have a Palo Alto Networks Firewall 3050 connected to a Cisco Catalyst 2960 Switch and I am using the following topology to demonstrate TAP configuration. As you can see the Laptop is connected to Cisco switch on port no G1/0/8 and the Palo Alto Firewall is connected to Cisco Switch port G1/0/1 . We will configure a SPAN in Cisco Switch and our source will be G1/0/8 ( Laptop) and the destination will be G1/0/1 ( Connected to Palo Alto Firewall). Basically we will monitor all the traffic from the host Laptop towards Internet. You can also configure RSPAN the principle remains the same.
Lets configure SPAN in Cisco Catalyst Switch using following CLI commands
monitor session 1 source interface gigabitEthernet 1/0/8 both
monitor session 1 destination interface gigabitEthernet 1/0/5
Configure Ethernet 1/5 as TAP mode by going to Network -> Interface -> ethernet1/5 -> Interface Type and select Tap
Assign a Security Zone to ethernet 1/5 as with out this we cannot create Security Rule to monitor the traffic
Name : Name of the zone you want -> Type : Should be TAP and add ethernet 1/5 to be part of new Zone you are creating as shown
Create a Security policy so that we can monitor the traffic in the logs tab and can also see the details in ACC tab, without configuring the Security Policy one cannot monitor the traffic spanning through the Palo Alto Network Firewall in TAP mode. Ensure that the rule is at the top and both the source zone and destination zone are same as demonstrated below
Policies -> Security -> Add
You can use any name you want
Add Source Zone – In our case its TAP_ZONE
Add Destination Zone – In our case its TAP_ZONE
Allow the traffic and click ok and commit to save the policy
You final policy should be like this
One can now see what kind of traffic is passing through the Palo Alto Network Firewall in TAP mode
Monitor -> Logs -> Traffic
Also one see more details like the risk level and what application are accessed in Application Command Center (ACC)
So far I have never experience such a granular report offered by any firewalls. This kinds of value added features obliviously makes Palo Alto Networks Firewall a leader in Next Generation Firewall.
Cisco Certification Tracking Tool is not working since almost a week , looks a like some major compromise happened with this portal. Once you login to any of the tracking sites you will some of these errors
Cisco also published a blog about this outage, well its quite unfortunate that an unauthorized third party placed malware on their Credential Manager System, which supports this Cisco Certifications Tracking System. Until this issue is fixed no one can verify Cisco Certifications.
I hope Cisco will fix this and have a permanent fix for this issue.
Since I received the “CCDE Study Guide” from Jamie Shoup till date, I simply couldn’t able resist reading such a wonder book from Marwan Al-shawi. I believe it was a great initiative from Marwan Al-shawi to write this book. Since I read this book from cover to cover I believe it’s the right time for me to write a complete review of this book.
As mentioned in my initial review , Marwan did a great job in penning down this title, he has gone an extra mile to come out with this title. The topics are organised well and he addressed almost all the topics of CCDE blue print at very high level. The “CCDE Study Guide” is divided into 6 parts with following chapters
Part I Business-Driven Strategic Network Design
- Chapter 1 Network Design Requirements: Analysis and Design Principles
Part II Next Generation – Converged Enterprise Network Architectures
- Chapter 2 Enterprise Layer 2 and Layer 3 Design
- Chapter 3 Enterprise Campus Architecture Design
- Chapter 4 Enterprise Edge Architecture Design
Part III Service Provider Networks Design and Architectures
- Chapter 5 Service Provider Network Architecture Design
- Chapter 6 Service Provider MPLS VPN Services Design
- Chapter 7 Multi-AS Service Provider Network Design
Part IV Data Center Networks Design
- Chapter 8 Data Center Network Design
Part V High Availability
- Chapter 9 Network High-Availability Design
Part VI Other Network Technologies and Services
- Chapter 10 Design of Other Network Technologies and Services
I enjoyed reading almost all the topics, yet got bored on the topics which I don’t have much exposure. The book is addressed at very high level. In order to enjoy this book one should posses good understanding of the concepts be it MPLS, MPLS TE, MPLS VPN or as simple as of Layer 2 Network Design. Marwan is no where attempting you to understand topics from grasp level. I can understand Marwan must have gone through tons of technical resources to come with such a wonderful title. His experience and knowledge is quite visible in the content he developed.
Few things which I really liked in this title are
- The design scenarios presented are quite useful and there are plenty of them
- The design goals one should consider
- The business driven factors
- Enormous amount of Diagrams which complement the text.
- The seamless flow of topics
- Design related Questions
- Further Reading Section
Its also good to see this title now part Safari Online, those who have Safari subscription can enjoy reading this book even for enhancing their design principles.
This title would have added extra value if the following things were considered
- A small design challenge at the end of each chapter based on exam pattern
- Hyperlinking all the reference materials ( few hyperlinks are there)
Over all a must read book not only for those who are perusing CCDE but also for those who are involved in Designing complex networks. Also I would like to thank Marwan Al-shawi for coming out with such a great book as its quite helpful to me.
With the introduction of ACI, Nexus 9k and many other SDN components I was expecting Cisco will soon announce the new version of CCIE Data Center.
As anticipated Cisco announced the revision of CCIE Data Center from Version 1.0 to 2.0, to be a CCIE Data Center v2.0, Cisco will be testing the candidate’s knowledge and capabilities on the latest skill and technologies which are broadly classified into six domains.
CCIE Data Center v1.0
CCIE Data Center v.20
When you compare Domain topics of CCIE Data Center v1.0 and Data Center v2.0 form above shown table one could notice Cisco is introducing more technology centric topics, the interesting catch here is Evolving Technologies . One could certainly experience below technical topics like in CCIE Data Center v2.0 exams
- Policy Driven Fabric (ACI)
Following are the some of the key hardware changes in the CCIE Data Center v.2.0 blueprint
- APIC Cluster
- Nexus 9300
- Nexus 7000 w/ F3 Module
- Nexus 5600
- Nexus 2300 Fabric Extender
- UCS 4300 M-Series Servers
I believe Cisco took a strategic decision to announce the new version of CCIE Data Center exam as this will empower them to capitalise the huge SDN market share, its been a general tendency of the customers to adopt the SDN solutions based on the availability of technical resources. I hope Cisco will certainly add value to their CCIE certifications and ensure strict guidelines are followed when it comes to delivery of the exam and also make their exams more realistic.
Those who are preparing for the CCIE Data Center v1.0 exam don’t need to panic as they have time until July 2, 2016.
- Last day to test for the v1.0 written – July 22, 2016
- First day to test for the v2.0 written – July 25, 2016
- Last day to test for the v1.0 lab – July 22, 2016
- First day to test for the v2.0 lab – July 25, 2016
One more change one is going to experience in CCIE Data Center v2.0 lab is the introduction of Diagnostic module which lasts for 60 minutes and focuses on the skills required to properly diagnose network issues, without having device access. The main objective of the Diagnostic module is to assess the skills required to properly diagnose network issues. These skills include:
- · Analyze
- · Correlate
– Discerning multiple sources of documentation (in example e-mail threads, network topology diagrams, console outputs, logs, and even traffic captures.)
In the Diagnostic module, candidates need to make choices between pre-defined options to indicate:
- · What is the root cause of an issue
- · Where is the issue located in the diagram
- · What is the critical piece of information allows us the identify the root cause
- · What piece of information is missing to be able to identify the root cause
However the Configuration and Troubleshooting module follows the same pattern of CCIE Data Center v1.0 , basically it consists of one topology where the candidate has to complete the given tasks in 7hours of time.
Since the introduction of Diagnostic module in CCIE R&S v 5.0 Cisco is keep on adding this module every new version of CCIE exams be it CCIE Service Provider or CCIE Data Center.
I wish all the CCIE Data Center aspirers a best of luck and I am pretty sure soon training materials will be out by Cisco Press and INE as they seems to be pioneers when it comes to CCIE Study Materials.
As discussed in one my post, we all know Palo Alto Networks Firewall allows us to implement in many modes, one such mode is TAP Mode. Now you all might be wondering what is a TAP mode?
TAP Mode is basically used to monitor the traffic passing through the firewall, basically a TAP Mode interface can be easily used for
- POC of Palo Alto Network Firewalls
- To monitor passively all the traffic passing across a network using SPAN or mirror port
One can easily configure SPAN/RSPAN in his/ her network Switch and pass the traffic thought the Palo Alto Firewall to monitor the traffic, by doing so one can have a complete visibility of the network and Palo Alto Networks really comes with a some great reports as well. This kind of monitoring can be done in TAP mode only, it reads all the spanned traffic and there will be a visibility in Palo Alto Network Firewall ACC tab.
To place a Palo Alto Networks Firewall one doesn’t need to do any changes to their existing network design also in TAP Mode the traffic will not blocked or any URL filtering can be enabled. It’s a really a cool feature from Palo Alto Networks Firewall , in my next post lets see how a Palo Alto Networks can be configured in TAP mode. One nice little feature Palo Alto Network Firewall supports is, it can process the encrypted SPAN traffic.
As these days my focus is more into Network security and my current job demands more of the security. Being a CCIE I thought rather than investing my time, energy and money on one more CCIE, I thought of staring the journey of JNCI-SEC . I was totally banking on assumptions and expectations , those who comes from Cisco back ground they know, technically there are no prerequisites to be a CCIE or CCDE. My assumptions were wrong and baseless, in reality one has to start from the scratch, especially if some one is planning to his/her start Juniper Certification track.
I was little disappointed but this never stopped me from planning certifications in the Network Security tracks, I changed my vision and realigned my plans and started focusing on Palo Alto, F5 and Cisco CCDE Certifications. I am currently focusing on CCDE as I did passed the Palo Alto PCNSE 7 exam and it was a great experience. Though we have some of the Juniper Firewalls in our setup yet I am not motivated to jump into the journey of JNCI-SEC because of the prerequisites.
Now coming back to Juniper Networks, I strongly believe they need to realign their vision and approach towards their expert level certifications, as at time those who hold expert level certifications from other vendors do get demotivated to start their journey from entry level certificate and then to professional and finally the expert level certifications. I am pretty sure if Juniper removes the prerequisites for their expert level certifications lot of experts would jump in to challenge themselves with Juniper Expert Level Certifications like JNCIE.
When it comes to Palo Alto Networks Firewall it supports wide range of deployment options and interface types as well. One can easily mix and match the interface types in real world deployments.
Most of the Palo Alto Networks Firewall support following interface types
- Ethernet – These are physical interfaces and can be configured as the following types
- Virtual Wire
- Layer 2
- Layer 3
It’s a know fact that one can use tap mode, virtual wire mode , layer 3 mode , layer 2 mode etc in a single Palo Alto Firewall. This is the beauty of Palo Alto Networks Firewall.
Also Palo Alto Networks Firewall supports following Interface Types
- Decrypt Mirror
I will try to address in detail about all the above mentioned interfaces in the upcoming post.
Recently I was provided with a copy of CISCO CERTIFIED DESIGN EXPERT which Orhan uses to teach his CCDE online classes, upon going through the workbook, I discovered his work book covers all the topics of CCDE blue print. The work book looks simple and easy to understand. The topics are covered in simple format I believe he relies more on his work book as a note and relies more on his online classes.
At the end of the each topic ,there are case studies followed by some questions on those topics , he concludes the topic with reference books for further studies, what videos one should watch online ( Cisco Live, podcast etc.) and also links to the articles one can refer for further information
He also concludes the work book with a complete scenario perhaps like an exam where you are challenged with questions and emails. You are suppose to answer these questions .
Personally I like the MPLS case study, the good thing about these case studies are they are quite short and concise, over all I could see a reflection of Service Provider experience and hard work of Orhan in developing this Work Book.
I would conclude by a recommendation to Orhan to enhance his content by adding more scenarios which are business driven, I am sure by adding this he will take his work book to the next level.
Over all I enjoyed reading CISCO CERTIFIED DESIGN EXPERT work book developed Orhan and I am thankful to him for sharing this valuable work with me. Personally it will certainly help me for my CCDE practical preparations.
Configuring a zone in Palo Alto firewall is quite easier, since most of the configuration tasks can be done at GUI level, it makes life easier of the Network Security Engineer, they can use their standard browser to access the Palo Alto Networks Firewall. In this example lets do the following
- Create a Layer 3 Zone called Trust
- Assign an interface to the newly created zone
Go to Palo A lot Networks firewall WebUI and select Network>Zones and then click Add to create a new zone
Click Add and create a Zone and name it Trust and type should be Layer 3 as shown below
Assign an interface to the newly created zone by clicking Add and then select the interface ( ethernet 1/1) and click ok.
Once you are done and click commit you should see the following final output which states the name of the zone followed by the type of the zone and what interfaces associated with it.
When it comes to zone configuration Palo Alto Network Firewalls are straight forward and easy. One could use the same template to configure any types of zone . In upcoming post lets see what is management profile and how it can be configured.