Configure Interfaces and Zones (PAN-OS)

1. Configure a default route to your Internet router.

   1. Select NetworkVirtual Router and then select the default link to open the Virtual Router dialog.
   2. Select the Static Routes tab and click Add. Enter a Name for the route and enter the route in the Destination field (for example, 0.0.0.0/0).
   3. Select the IP Address radio button in the Next Hop field and then enter the IP address and netmask for your Internet gateway (for example, 203.0.113.1).

   4. Click OK twice to save the virtual router configuration.
2. Configure the external interface (the interface that connects to the Internet).

   1. Select NetworkInterfaces and then select the interface you want to configure. In this example, we are configuring Ethernet1/8 as the external interface.
   2. Select the Interface Type. Although your choice here depends on interface topology, this example shows the steps for Layer3.
   3. On the Config tab, select New Zone from the Security Zone drop-down. In the Zone dialog, define a Name for new zone, for example Internet, and then click OK.
   4. In the Virtual Router drop-down, select default.
   5. To assign an IP address to the interface, select the IPv4 tab, click Add in the IP section, and enter the IP address and network mask to assign to the interface, for example 203.0.113.23/24.

   6. To enable you to ping the interface, select AdvancedOther Info, expand the Management Profile drop-down, and select New Management Profile. Enter a Name for the profile, select Ping and then click OK.
   7. To save the interface configuration, click OK.
3. Configure the interface that connects to your internal network.

   In this example, the interface connects to a network segment that uses private IP addresses. Because private IP addresses cannot be routed externally, you have to configure NAT.

   1. Select NetworkInterfaces and select the interface you want to configure. In this example, we are configuring Ethernet1/15 as the internal interface our users connect to.
   2. Select Layer3 as the Interface Type.
   3. On the Config tab, expand the Security Zone drop-down and select New Zone. In the Zone dialog, define a Name for new zone, for example Users, and then click OK.
   4. Select the same Virtual Router you used previously, default in this example.
   5. To assign an IP address to the interface, select the IPv4 tab, click Add in the IP section, and enter the IP address and network mask to assign to the interface, for example 192.168.1.4/24.
   6. To enable you to ping the interface, select the management profile that you just created.
   7. To save the interface configuration, click OK.
4. Configure the interface that connects to your data center applications.

   Make sure you define granular zones to prevent unauthorized access to sensitive applications or data and eliminate the possibility of malware moving laterally within your data center.

   1. Select the interface you want to configure.
   2. Select Layer3 from the Interface Type drop-down. In this example, we are configuring Ethernet1/1 as the interface that provides access to your data center applications.
   3. On the Config tab, expand the Security Zone drop-down and select New Zone. In the Zone dialog, define a Name for new zone, for example Data Center Applications, and then click OK.
   4. Select the same Virtual Router you used previously, default in this example.
   5. To assign an IP address to the interface, select the IPv4 tab, click Add in the IP section, and enter the IP address and network mask to assign to the interface, for example 10.1.1.1/24.
   6. To enable you to ping the interface, select the management profile that you created.
   7. To save the interface configuration, click OK.
5. (Optional) Create tags for each zone.

   Tags allow you to visually scan policy rules.

   1. Select ObjectsTags and Add.
   2. Select a zone Name.
   3. Select a tag Color and click OK.

6. Save the interface configuration.

   Click Commit.
7. Cable the NGFW.

   Attach straight through cables from the interfaces you configured to the corresponding switch or router on each network segment.
8. Verify that the interfaces are active.

   Select Dashboard and verify that the interfaces you configured show as green in the Interfaces widget.