102
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Use
Case:
Configure
Firewalls
Using
Panorama
Manage
Firewalls
3.
Deploy
the
software
updates
to
the
firewalls.
a.
Select
Panorama > Device Deployment > Software
.
b.
Click
Check Now
to
check
for
the
latest
updates.
If
the
value
in
the
Action
column
is
Download
,
this
indicates
an
update
is
available.
c.
Locate
the
version
that
you
need
for
each
hardware
model
and
click
Download
.
When
the
download
completes,
the
value
in
the
Action
column
changes
to
Install
.
d.
In
the
Action
column,
click
the
Install
link.
Use
the
filters
or
user
‐
defined
tags
to
select
the
managed
firewalls
on
which
to
install
this
version.
e.
Enable
the
check
box
for
Reboot device after install
or
Upload only to device (do not install)
and
click
OK
.
The
Results
column
displays
the
success
or
failure
of
the
installation.
Use
Templates
to
Administer
a
Base
configuration
TASK
2
Use
Templates
to
administer
a
base
configuration.
1.
For
each
template,
perform
the
task
and
assign
the
appropriate
firewalls
to
each.
2.
Define
a
DNS
server,
NTP
server,
Syslog
server,
and
login
banner.
Repeat
this
step
for
each
template.
a.
In
the
Device
tab,
select
the
Template
from
the
drop
‐
down.
b.
Select
Setup > Services
and
edit
the
Services
section:
enter
an
IP
address
for
the
Primary DNS Server
and
Primary NTP Server
.
c.
To
add
a
login
banner,
select
Device > Setup > Management
and
edit
the
General
Settings
section:
add
the
text
for
the
Login Banner
and
click
OK
.
d.
To
add
a
syslog
server,
select
Device > Server Profiles > Syslog
,
click
Add
,
enter
a
Name
for
the
profile,
and
click
Add
to
specify
the
information
(as
follows)
required
to
connect
to
the
Syslog
server.
You
can
add
up
to
four
servers
to
the
same
profile.
After
you
finish
adding
servers,
click
OK
to
save
the
server
profile.
–
Name
—Unique
name
for
the
server
profile.
–
Server
—IP
address
or
fully
qualified
domain
name
(FQDN)
of
the
Syslog
server.
–
Port
—The
port
number
on
which
to
send
Syslog
messages
(default
is
514);
you
must
use
the
same
port
number
on
Panorama
and
the
Syslog
server.
–
Facility
—Select
one
of
the
Syslog
standard
values,
which
is
used
to
calculate
the
priority
(PRI)
field
in
your
Syslog
server
implementation.
You
must
select
the
value
that
maps
to
how
you
use
the
PRI
field
to
manage
your
Syslog
messages.
3.
Enable
HTTPS,
SSH,
and
SNMP
access
to
the
management
interface
of
the
managed
firewalls.
Repeat
this
step
for
each
template.
a.
In
the
Device
tab,
select
the
Template
from
the
drop
‐
down.
b.
Select
Setup > Management
,
and
edit
the
Management
Interface
Settings
section.
c.
Under
Services,
select
the
HTTPS
,
SSH
,
and
SNMP
check
boxes,
then
click
OK
.
4.
Create
a
zone
protection
profile
for
the
firewalls
in
the
Datacenter
Template
(T_DataCenter).
a.
Select
the
Network
tab
and,
in
the
Template
drop
‐
down,
select
T_DataCenter.
b.
Select
Network Profiles > Zone Protection
and
click
Add
.
c.
For
this
example,
enable
protection
against
a
SYN
flood—In
the
Flood Protection
tab,
select
the
SYN
check
box,
set
the
Action
to
SYN Cookies
as,
set
the
Alert
packets/second
to
100
,
set
the
Activate
packets/second
to
1000
,
and
set
the
Maximum
packets/second
to
10000
.
d.
For
this
example,
enable
alerts—In
the
Reconnaissance Protection
tab,
select
the
Enable
check
boxes
for
TCP
Port Scan
,
Host Sweep
,
and
UDP Port Scan
.
Ensure
the
Action
values
are
set
to
alert
(the
default
value).
e.
Click
OK
to
save
the
zone
protection
profile.
Deploy
Content
Updates
and
PAN
‐
OS
Software
Updates
to
the
Managed
Firewalls
(Continued)
