CloudLabBox
Try the free demo

Palo Alto NGFW lab 1 of 30

First boot and initial configuration

Take a factory-new PAN-OS 11.2 VM-Series firewall from its first console login to a managed device: forced password change, static management interface, hostname, DNS, banner, time zone and locked-down management access, then log in to the web interface.

Run this lab

It needs Lite: its 2 nodes are set to 3 vCPU and 6,656 MB in total. That fits the free demo too.

In your workspace: Shared, then Palo Alto NGFW PAN-OS 11 guided labs, then 01 - First boot and initial configuration

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Beginner
Time
About 45 minutes
Nodes need
3 vCPU, 6,656 MB
Smallest plan
Lite

The scenario

Calder Logistics has bought a PA-VM firewall for its Leeds depot. It arrived straight from the factory: no IP address on its management port, the default password and nothing configured. Your job today is the "day 0" setup a firewall engineer does before anyone can manage the box over the network:

  • get in through the serial console;
  • give the management port a fixed address;
  • set the basics (hostname, DNS, time zone and banner);
  • make sure only the right people, from the right network, can reach the management interface.
DeviceAddressHow you reach itLogin
FW1 management port10.1.1.254/24, gateway 10.1.1.1 (after Task 3)Console (telnet) now; https://10.1.1.254 lateradmin / admin first, then admin / Lab-Access-1
Client-PC10.1.1.10/24Double-click it: a Linux desktop opens in your browseropens directly

The firewall's management port and Client-PC share the Inside switch. Nothing else is connected yet: interfaces and routing come in lab 04.

Boot time. A PAN-OS firewall takes about 6-8 minutes to start. For the first few minutes the console shows login: but answers Login incorrect even with the right password, because the management server isn't running yet. Wait and try again. When the prompt changes to PA-VM login:, it's ready.

What you’ll practise

  • Log in to a factory-default firewall and complete the forced password change
  • Read the firewall's model, software and content versions with operational commands
  • Configure the management interface, hostname and domain from the CLI and commit
  • Explain the difference between the candidate and running configuration
  • Use the web interface to set the login banner, time zone and DNS servers
  • Restrict management access to permitted addresses and secure services

The tasks

  1. First login and the forced password change
  2. Find out what you are working with
  3. Configure the management interface from the CLI
  4. Log in to the web interface
  5. Banner, time zone and DNS in the web interface
  6. Lock down management access

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of First boot and initial configuration2 nodes and 1 network, 2 links. Every link is listed as text below the diagram.FW1Client-PCInsidemgmteth0
2 nodes and 1 network, with the interface names each link uses.
Every link, as text
  • FW1 mgmt to Inside (network)
  • Client-PC eth0 to Inside (network)
Nodes in First boot and initial configuration, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
FW1Palo Alto Networks VM-Series (PAN-OS)paloalto-11.2.52 vCPU, 5,632 MB
Client-PCEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Palo Alto NGFW PAN-OS 11 guided labs.

  3. Open 01 - First boot and initial configuration and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Palo Alto NGFW labs

All Palo Alto NGFW labs

Related labs in other courses

CloudLabBox is independent of Palo Alto Networks and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.