PANW best practices from Day 0

In my blog, I’ve often mentioned that Palo Alto Networks (PANW) firewalls are feature-rich, offering a wide range of configurations across multiple areas. There are many steps involved in setting up a firewall according to best practices. Unfortunately, I often see subpar configuration quality. In a previous blog post, I discussed how to measure the effectiveness of your deployment.

So, how can we get as close as possible to best practices right from the start of a deployment? Palo Alto Networks provides a tool called IronSkillets. IronSkillets are Day 0 configuration best practices, applying settings in areas such as:

• Security
• Device Hardening
• Logging and Reports

After applying IronSkillets, you’ll have a baseline configuration that aligns with best practices from the outset. How can you apply IronSkillets? There are two main methods.

For New Deployments: The best way to apply IronSkillets for a new setup is to generate a template from the Customer Support Portal (CSP). Navigate to the relevant section in the CSP and fill out the form with basic information. This will generate an XML configuration file.

Prerequisites: Before implementing the XML file on the firewall, ensure that at least the Threat Prevention (TP) license is activated, and TP and Antivirus packages are installed. Without these, some security configurations won’t be applied. Keep in mind that this approach will replace the current configuration, so it’s only suitable for new deployments.

For Existing Deployments: If your firewall or Panorama is already in production, you can implement IronSkillets using set commands via the CLI. IronSkillets are also available on GitHub. You can find the set commands and an Excel file in the following repository:

IronSkillets on GitHub

The set commands are in the second sheet of the Excel file. Simply copy and paste them into the CLI of your firewalls.

Before IronSkillets, I used a startup checklist for every new deployment. IronSkillets save time, simplify initial deployment, and improve configuration quality. If you use Panorama, you can apply IronSkillets to a dedicated template and share the configuration across your infrastructure.