Configuring a Palo Alto Networks PA-Series firewall correctly requires a different mental model from legacy firewall setup. This guide covers the key configuration steps for a typical Indian enterprise deployment — security zones, App-ID policies, WildFire, GlobalProtect VPN, and Panorama for multi-site management.
Before You Begin — Understand the PAN-OS Policy Model
A Palo Alto firewall does NOT work like a legacy firewall where you create rules based on IP addresses and port numbers. PAN-OS policy is structured around:
- Security Zones — logical groupings of interfaces (Trust, Untrust, DMZ, etc.)
- Security Policies — rules that allow or deny traffic between zones, based on application (App-ID), user (User-ID), and content (Content-ID)
- NAT Policies — address translation rules (outbound PAT, inbound DNAT for servers)
- Decryption Policies — SSL/TLS inspection rules
- Security Profiles — antivirus, IPS, URL filtering, WildFire, and anti-spyware attached to security policies
This is fundamentally different from IP/port rules. Take time to understand zones and the App-ID model before starting configuration.
Step 1 — Initial Setup and Management Access
Connect to the management port:
- Connect a laptop directly to the MGMT port of the PA-Series (default IP: 192.168.1.1)
- Set your laptop to 192.168.1.x subnet
- Browse to https://192.168.1.1 — accept the self-signed certificate
- Login with admin/admin (default — change immediately)
First-time setup wizard:
- Set a strong admin password
- Set the management interface IP to your management network address
- Set DNS servers and NTP server (use IST timezone: Asia/Kolkata)
- Register the device at support.paloaltonetworks.com with your serial number
- Activate subscriptions (Threat Prevention, WildFire, URL Filtering) from the device registration portal
Step 2 — Interface Configuration and Security Zones
Create security zones: In Network → Zones, create your zone structure:
- Untrust — WAN/internet-facing interface
- Trust — LAN/internal users interface
- DMZ — servers accessible from the internet (if applicable)
- VPN — for GlobalProtect tunnel zone
Configure interfaces: In Network → Interfaces:
- Assign each physical interface a zone, IP address, and interface type
- For most SMB deployments: ethernet1/1 = Untrust (WAN), ethernet1/2 = Trust (LAN)
- Virtual wire, Layer 2, or Layer 3 modes available — Layer 3 is standard for India deployments
Routing: In Network → Virtual Routers → default → Static Routes:
- Add default route: 0.0.0.0/0 → next hop = ISP gateway on Untrust interface
- Add internal routes as needed
Step 3 — Security Policy — App-ID First Approach
The wrong approach (legacy thinking):
Source: Trust → Destination: Untrust → Port: 80,443 → Allow
This is a legacy firewall rule. On Palo Alto, this creates an "any application" rule — it allows everything, giving you no visibility or control.
The correct App-ID approach:
Create specific application rules:
Rule: Allow-Web-Browsing
Source Zone: Trust | Destination Zone: Untrust
Application: web-browsing, ssl
Action: Allow
Profile: Antivirus + URL Filtering + WildFire
Rule: Allow-Microsoft-365
Source Zone: Trust | Destination Zone: Untrust
Application: ms-office365-base, ms-teams
Action: Allow
Profile: Antivirus + WildFire
Rule: Allow-DNS
Source Zone: Trust | Destination Zone: Untrust
Application: dns
Action: Allow
Rule: Block-All
Source Zone: Trust | Destination Zone: Untrust
Application: any
Action: Deny
Log: Yes
The Block-All rule at the bottom ensures anything not explicitly allowed is blocked and logged.
Important: Add your rules above the Block-All rule. Palo Alto evaluates rules top-down, first match wins.
Step 4 — Outbound NAT
In Policies → NAT:
NAT Rule: Outbound-PAT
Source Zone: Trust
Destination Zone: Untrust
Source Address: 192.168.0.0/24 (your LAN)
Translation Type: Dynamic IP and Port
Translated Address: Interface Address (Untrust)
This is standard outbound PAT — all internal users share the WAN IP for internet access.
For multiple WAN links (dual ISP), create separate NAT rules per ISP and use PBF (Policy Based Forwarding) to route specific traffic over specific links.
Step 5 — Security Profiles — Activating Threat Prevention
Security policies alone don't inspect content. Attach Security Profiles to policies to activate:
Antivirus Profile: In Objects → Security Profiles → Antivirus:
- Set action to Block for known malware signatures
- Enable WildFire analysis for unknown files
Anti-Spyware Profile: In Objects → Security Profiles → Anti-Spyware:
- Enable all severity levels (Critical, High, Medium)
- Enable DNS sinkholing (requires DNS Security subscription)
- Set action to Block for C2 traffic
Vulnerability Protection (IPS): In Objects → Security Profiles → Vulnerability Protection:
- Enable all severity levels
- Set Critical and High to Block; Medium and Low to Alert initially
URL Filtering Profile: In Objects → Security Profiles → URL Filtering:
- Block: malware, phishing, command-and-control, hacking, questionable
- Alert: social-media, games (review these with your policy team)
- Allow: business, technology, news
WildFire Analysis Profile: In Objects → Security Profiles → WildFire Analysis:
- Set all file types to Forward (send to WildFire cloud for analysis)
- This applies to exe, dll, pdf, Office files, JAR files, APKs, and scripts
Create a Security Profile Group: In Objects → Security Profile Groups → New:
- Name: Standard-Profile
- Attach all the profiles above to this group
Then attach this group to every Allow rule in your security policy.
Step 6 — WildFire Activation Verification
After subscribing to WildFire, verify it is active:
- Device → Setup → WildFire — confirm the WildFire server is set (wildfire.paloaltonetworks.com)
- Monitor → Logs → WildFire Submissions — after 24 hours of production traffic, you should see files being submitted to WildFire for analysis
- Device → Licenses — confirm WildFire subscription shows as active with an expiry date
Step 7 — GlobalProtect VPN Setup
GlobalProtect provides VPN access for remote workers with the same NGFW policy applied to their traffic.
Setup steps:
- Create a GlobalProtect Gateway on an internal interface (or Untrust with IP)
- Create a GlobalProtect Portal on the Untrust interface (the public IP users connect to)
- Create an SSL certificate for the portal (use a CA-signed cert, not self-signed, for production)
- Configure an IP pool for VPN clients (e.g. 10.10.10.0/24)
- Configure user authentication — Active Directory or RADIUS
- Create a security policy: Trust (GP Zone) → Trust (LAN), applications: your allowed apps
- Distribute the GlobalProtect agent to end users (Windows, Mac, iOS, Android)
Remote users connect to the portal URL, authenticate, and receive the VPN tunnel. Their traffic routes through the PA-Series firewall and is subject to all security policies.
Step 8 — User-ID Integration (AD)
For user-based policy, configure User-ID to map IP addresses to Active Directory users.
Windows-based User-ID agent:
- Install the User-ID Agent on a Windows server that can read AD event logs
- Configure the agent with AD domain credentials
- In the Palo Alto: Device → User Identification → User-ID Agents → add your agent
- Verify user mappings in Monitor → Logs → User-ID
Inline mapping (for environments where the Palo Alto is the default gateway): Device → User Identification → User Mapping → Captive Portal — captures users who haven't authenticated via domain login.
Once User-ID is active, security policies can reference AD user groups instead of IP ranges.
Step 9 — Panorama (Multi-Site Deployments)
For organisations with 2+ PA-Series firewalls across multiple Indian offices, Panorama provides centralised management.
Panorama setup:
- Deploy Panorama M-Series or VM appliance on your management network
- Register Panorama at support.paloaltonetworks.com
- Add managed devices: Panorama → Managed Devices → Add — enter each firewall's serial number
- Create Device Groups (e.g. "All-Firewalls", "Mumbai-Office", "Delhi-Office") for shared policy
- Create Templates for shared network configuration (DNS, NTP, routing)
- Push shared policies from Panorama to all managed firewalls
Policy hierarchy with Panorama:
- Pre-rules (pushed from Panorama, cannot be changed locally): corporate-wide block rules
- Local rules (configured on each firewall for site-specific requirements)
- Post-rules (pushed from Panorama): default deny
This ensures every site has consistent base security policy while allowing site-specific exceptions.
Common Indian Deployment Mistakes
Mistake 1: Using "any-any-allow" rules initially — creates no visibility and defeats the purpose of an NGFW. Start with App-ID rules from day one.
Mistake 2: Not attaching security profiles — a security policy that allows traffic without a WildFire or Antivirus profile does not inspect that traffic. Every Allow rule must have profiles attached.
Mistake 3: Skipping WildFire subscription — the PA-Series hardware includes App-ID and User-ID but WildFire is a separate subscription. Without it, unknown files are not sandboxed.
Mistake 4: Not enabling SSL decryption — approximately 80–90% of internet traffic is encrypted. Without TLS decryption, the NGFW cannot see inside encrypted traffic. Set up decryption policies with proper certificate deployment to internal clients.
Cloudfy Systems provides complete Palo Alto Networks deployment services for Indian organisations — security zone design, App-ID policy configuration, WildFire activation, GlobalProtect VPN, and Panorama setup. Contact our authorised Palo Alto Networks team in India for a deployment proposal.